Junglewise Threat Intelligence

CVE-2026-60119: HiEvents Hi.Events stored XSS via event title in inline scripts

CVE-2026-60119 · Severity: medium · CVSS 5.4 · Published 2026-07-14

Technologies: HiEventsDev Hi.Events. Vendors: HiEventsDev.

Executive brief

Hi.Events is an open-source event management and ticketing platform. A security vulnerability allows users with event creation or editing permissions to inject malicious scripts into event titles. When other users, including administrators or public visitors, view the affected event page, the malicious script executes in their browser. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Hi.Events through version 1.10.0-beta. The vulnerability occurs because the event title field is serialized using JSON.stringify() and embedded directly into inline <script> tags within the application/ld+json structured data block and the server-side rehydrated state. Since JSON.stringify() does not escape the '</script>' sequence by default, an attacker with event creation or edit permissions can provide a title containing this sequence to break out of the script context and inject arbitrary HTML or JavaScript. The payload executes in the context of any user viewing the event page, including unauthenticated visitors and administrators. The issue is fixed in version 1.11.0-beta by properly escaping user-controlled data before embedding it in inline script contexts and stripping control characters.

Affected products

  • HiEventsDev Hi.Events <= v1.10.0-beta

Timeline

  • 2026-07-07: patched: Fix committed to main branch
  • 2026-07-09: patched: Version 1.11.0-beta released
  • 2026-07-13: advisory: GitHub Security Advisory published
  • 2026-07-14: disclosed: CVE published to NVD

References

Related threats