Executive brief
Cockpit CMS is a popular open-source content management system. A stored cross-site scripting vulnerability in its content collection interface allows low-privilege editors to inject malicious code that executes when administrators view item lists. An attacker can steal administrator session credentials and authentication tokens, leading to full account takeover and unauthorized administrative access.
Technical details
The vulnerability is a stored XSS (CWE-79) in the field-tags.js and field-select.js Vue components. The root cause is that field render() output is passed directly to Vue's v-html directive without output encoding or sanitization. An attacker with content write access (via API key or authenticated editor session) can inject arbitrary JavaScript payloads into tags or select fields via the API. The payload persists in the database and executes in the browser of any administrator or editor who views the affected collection's item list. Additionally, Cockpit stores session cookies without the HttpOnly flag and exposes the CSRF JWT in JavaScript globals, allowing the injected XSS to steal both tokens and replay them for session hijacking. The fix involves sanitizing render output using App.utils.stripTags() before passing to v-html, and hardening session cookies with HttpOnly, Secure, and SameSite flags.
Affected products
- Cockpit HQ Cockpit CMS 2.13.5 and before
Timeline
- 2026-03-29: disclosed: Vulnerability reported to Cockpit CMS maintainers
- 2026-03-29: patched: Fix released by maintainers (commit d70dc50)
- 2026-04-04: advisory: CVE requested
- 2026-06-23: other: CVE-2026-39275 assigned
- 2026-08-26: other: Public disclosure