CVE-2026-23695

Medium

Description

Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, where the template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization. An attacker with content/:models/manage permission can inject arbitrary JavaScript into the Display template, which executes in the browser of any user viewing the collection items list.

SeverityMedium

CVSS5.4

Exploit probability—

ProductCockpit-hq/cockpit

PublishedMay 15, 2026

First seenMay 15, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Patches

github.com/Cockpit-HQ/Cockpit/commit/72a83fcfe85ad8330e9ae834bc02fa517b5749e9

Affected products

Product	Affected versions	Fixed in
cockpit-hq/cockpitPackagist	v ≤ 2.14.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.