# CVE-2026-60119: HiEvents Hi.Events stored XSS via event title in inline scripts

Source: https://junglewise.ai/threats/cve-2026-60119-hievents-hi-events-stored-xss-via-event-title-in-inline-scripts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-60119 · Severity: medium · CVSS 5.4 · Published 2026-07-14

Hi.Events is an open-source event management and ticketing platform. A security vulnerability allows users with event creation or editing permissions to inject malicious scripts into event titles. When other users, including administrators or public visitors, view the affected event page, the malicious script executes in their browser. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.

Technologies: [HiEventsDev Hi.Events](https://junglewise.ai/threats/technologies/hi-events). Vendors: [HiEventsDev](https://junglewise.ai/threats/vendors/hieventsdev).

## Quick answers

**Is CVE-2026-60119 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60119 being exploited in the wild.

**How severe is CVE-2026-60119?** Medium severity, with a CVSS score of 5.4, published 14 July 2026.

**Which products and versions are affected?** HiEventsDev Hi.Events <= v1.10.0-beta.

**Is there a fix for CVE-2026-60119?** A patch was published on 2026-07-07: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-60119 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-60119?** Check whether you run HiEventsDev Hi.Events at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Hi.Events through version 1.10.0-beta. The vulnerability occurs because the event title field is serialized using JSON.stringify() and embedded directly into inline <script> tags within the application/ld+json structured data block and the server-side rehydrated state. Since JSON.stringify() does not escape the '</script>' sequence by default, an attacker with event creation or edit permissions can provide a title containing this sequence to break out of the script context and inject arbitrary HTML or JavaScript. The payload executes in the context of any user viewing the event page, including unauthenticated visitors and administrators. The issue is fixed in version 1.11.0-beta by properly escaping user-controlled data before embedding it in inline script contexts and stripping control characters.

## Affected products

- HiEventsDev Hi.Events <= v1.10.0-beta

## Timeline

- 2026-07-07: patched: Fix committed to main branch
- 2026-07-09: patched: Version 1.11.0-beta released
- 2026-07-13: advisory: GitHub Security Advisory published
- 2026-07-14: disclosed: CVE published to NVD

## References

- [https://github.com/HiEventsDev/Hi.Events/commit/1e36b070771801ed7113255ef7b3a7f271a2a794](https://github.com/HiEventsDev/Hi.Events/commit/1e36b070771801ed7113255ef7b3a7f271a2a794)
- [https://github.com/HiEventsDev/Hi.Events/pull/1260](https://github.com/HiEventsDev/Hi.Events/pull/1260)
- [https://github.com/HiEventsDev/Hi.Events/releases/tag/v.1.11.0-beta](https://github.com/HiEventsDev/Hi.Events/releases/tag/v.1.11.0-beta)
- [https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2ggx-79g6-2jmj](https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2ggx-79g6-2jmj)
- [https://www.vulncheck.com/advisories/hi-events-beta-xss-via-event-title-json-stringify-injection](https://www.vulncheck.com/advisories/hi-events-beta-xss-via-event-title-json-stringify-injection)

## Related threats

- [Hi.Events missing authorization for hidden tickets in order creation](https://junglewise.ai/threats/cve-2026-60118-hi-events-missing-authorization-for-hidden-tickets-in-order)
- [Hi.Events unauthenticated PII exposure in public check-in list](https://junglewise.ai/threats/cve-2026-57960-hi-events-unauthenticated-pii-exposure-in-public-check-in-list)
- [HiEvents Hi.Events promo code usage limit bypass](https://junglewise.ai/threats/cve-2026-57959-hievents-hi-events-promo-code-usage-limit-bypass)