CVE-2026-5301 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in coolercontrol-ui

CVE-2026-5301

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in coolercontrol-ui PUBLISHED

Description (CNA)

Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisoned log entries

Affected (CNA)

Vendor / product	Versions
CoolerControl / coolercontrol-ui	affected 2.0.0 before 4.0.0

CWE

CWE-79

References

https://gitlab.com/coolercontrol/coolercontrol/-/blob/2.0.0/coolercontrol-ui/src/views/AppInfoView.vue?ref_type=tags#L224
https://gitlab.com/coolercontrol/coolercontrol/-/blob/3.1.1/coolercontrol-ui/src/views/AppInfoView.vue?ref_type=tags#L350
https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.