BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-75599HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.

5.4 MEDIUMEPSS 0.16%Not in KEVNVD: Received

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
5.4MEDIUM3.1GitHub_M (CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CVE ID
CVE-2026-75599
Status
Received
Assigner (CNA)
GitHub_M
Published
Nov 5, 2026
Last modified
2026-11-05 17:18 UTC
Weaknesses
  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:46 UTC.