Hydro @hydrooj/ui-default: Stored cross-site scripting (CVE-2026-126800)
Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script through profile bio fields.
CVE search metadata
CVE search record: CVE-2026-126800. Severity: high. CVSS: 8.7. KEV: no. Product: @hydrooj/ui-default (< 4.59.1). Brief: Hydro @hydrooj/ui-default: Stored cross-site scripting (CVE-2026-126800). Brief link: https://feed.craftedsignal.io/briefs/2026-11-hydro-xss-cve-2026-126800/
Triage facts
Revision 1- Applicability
- @hydrooj/ui-default (< 4.59.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability. The flaw allows registered users to inject scripts by placing double quotes in language-class tokens within markdown-it-xss.ts.
Impact
Attackers can store a payload in their profile bio that executes when administrators or other users view it, potentially leading to the theft of non-httpOnly sid session cookies and session hijacking.
Recommendation
Update the affected software as specified by the vendor.