HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…omebox/security/advisories/GHSA-h4x5-6587-jpwp Diğer
• github.com/…ommit/d76b1c9b94e91cd74e56ef8a129325d70835471f Diğer
• github.com/sysadminsmedia/homebox/releases/tag/v0.27.0 Diğer

Kayıt geçmişi

1. 5 Kas 2026 19:02Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-85287HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
• 3,7 CVE-2026-85286HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
• 6,4 CVE-2026-116680Homebox genel bildirim alıcısında yönlendirme sonrası SSRF açığı
• 8,6 CVE-2026-105607Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0
• 7,5 CVE-2026-115452Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6
• 7,6 CVE-2026-102615HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS