CVE-2026-23695: Cockpit CMS Stored XSS Vulnerability in Set Field Type Display Template
Summary
CVE-2026-23695: Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option. Affects cockpit-hq/cockpit versions < 2.14.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cockpit CMS is a popular open-source content management system designed for building and managing websites. It offers a user-friendly interface and a variety of features, including customizable fields for content types. However, versions up to 2.14.0 are vulnerable to a stored cross-site scripting (XSS) attack, which can compromise the security of applications using this CMS.
Vulnerability Detail
The vulnerability arises from the Set field type's Display template option, where the template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without proper sanitization. This flaw allows an attacker with content/models/manage permission to inject arbitrary JavaScript into the Display template. When users view the collection items list, the injected JavaScript executes in their browsers, potentially leading to data theft, session hijacking, or other malicious activities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the Set field type's Display template option for users who do not require it. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The stored cross-site scripting vulnerability in Cockpit CMS poses a significant risk to applications using versions up to 2.14.0. It is crucial to update to the patched version to safeguard against potential attacks. Utilizing tools like Vulert can help monitor for vulnerabilities and ensure your application remains secure.
See every vulnerability recorded for cockpit-hq/cockpit →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected content.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to user data, session hijacking, and other malicious activities that compromise the integrity and security of your application.
Yes, the vulnerability has been patched in Cockpit CMS version 2.14.1. It is recommended to update to this version or later to mitigate the risk.
If immediate updates are not possible, implement access restrictions to the vulnerable feature and monitor your application for any suspicious activity until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-hq/cockpit.
