Executive brief
Cockpit CMS, a content management system used to manage and distribute digital content, is vulnerable to a security flaw in its 'Set' field type. An attacker with specific content management permissions can inject malicious scripts into display templates. When other users, such as administrators, view the list of items in that collection, the script executes in their browser, potentially allowing the attacker to steal session information or perform unauthorized actions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Cockpit CMS through version 2.14.0. The root cause is located in the 'Set' field type's 'Display template' option, where template strings are processed by the $interpolate function using the 'new Function()' constructor and subsequently rendered via Vue's 'v-html' directive without proper sanitization. An attacker with 'content/:models/manage' permissions can inject arbitrary JavaScript into the template. This script is executed in the browser of any user who views the collection items list. The vulnerability was addressed in commit 72a83fc by replacing the Function-based evaluation with a sandboxed JSLite execution environment.
Affected products
- Cockpit-HQ Cockpit CMS <= 2.14.0
Timeline
- 2026-05-15: disclosed
- 2026-05-15: advisory: NVD publication date
- 2026-05-21: other: GitHub Advisory reviewed