Hydro - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/hydro/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:08:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHydro @hydrooj/ui-default: Stored cross-site scripting (CVE-2026-126800)https://feed.craftedsignal.io/briefs/2026-11-hydro-xss-cve-2026-126800/Wed, 11 Nov 2026 22:08:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-hydro-xss-cve-2026-126800/Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script through profile bio fields.Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability. The flaw allows registered users to inject scripts by placing double quotes in language-class tokens within markdown-it-xss.ts.

Impact

Attackers can store a payload in their profile bio that executes when administrators or other users view it, potentially leading to the theft of non-httpOnly sid session cookies and session hijacking.

Recommendation

Update the affected software as specified by the vendor.

]]>highadvisory