Unzureichende Neutralisierung von Eingaben während der Webseitengenerierung ('Cross-site Scripting') in coolercontrol-ui

The impact of this XSS vulnerability is significant, as it allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to the theft of sensitive information, such as session cookies, authentication tokens, and personally identifiable information (PII). Attackers could also use this vulnerability to redirect users to malicious websites, deface the application, or perform other actions on behalf of the user. The lack of authentication requirement means that any user can trigger this vulnerability by injecting malicious code into a log entry, expanding the potential attack surface.

Organizations using coolercontrol-ui in production environments, particularly those with publicly accessible log viewers, are at risk. Shared hosting environments where multiple users share the same coolercontrol-ui instance are also particularly vulnerable, as an attacker could potentially inject malicious log entries that affect other users.

• vue / generic web:

curl -s 'http://<coolercontrol-ui-url>/log' | grep -i '<script>' 

• vue / generic web:

curl -s 'http://<coolercontrol-ui-url>/log' | grep -i 'onerror='

• vue / generic web:

curl -s 'http://<coolercontrol-ui-url>/log' | grep -i 'javascript:'

1. 2026-04-08Disclosure

   disclosure

1. Reserviert2026-04-01
2. Veröffentlicht2026-04-08
3. EPSS aktualisiert2026-04-16

The primary mitigation for CVE-2026-5301 is to upgrade coolercontrol-ui to version 4.0.0 or later, which contains the fix for this vulnerability. As an immediate workaround, implement strict input sanitization and output encoding on all user-supplied data that is displayed in the log viewer. This can help prevent the execution of malicious JavaScript code. Consider using a Web Application Firewall (WAF) to filter out potentially malicious requests. Regularly review and update your security policies and procedures to ensure that they are aligned with industry best practices.