Executive brief
CoolerControl is a cooling and monitoring utility for Linux systems. A security vulnerability in its user interface allows unauthenticated attackers to inject malicious code into the system's logs. If an administrator views these logs, the attacker can take control of the service, potentially leading to unauthorized system changes or data access.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the log viewer component of coolercontrol-ui (specifically within AppInfoView.vue). The application fails to properly neutralize input before displaying log entries to the user. An unauthenticated attacker can exploit this by generating malicious log entries containing JavaScript. When a user with administrative privileges views these logs, the script executes in their browser context, allowing the attacker to perform actions on behalf of the user or take over the service. This issue is resolved in version 4.0.0.
Affected products
- CoolerControl coolercontrol-ui >= 2.0.0, < 4.0.0
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched: Fixed in version 4.0.0