5.4

CVE-2026-33061

Exploit

Jexactyl has Stored DOM Cross-Site Scripting (XSS) via unescaped JSON in Blade template

Jexactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd inject server-side objects into client-side JavaScript through resources/views/templates/wrapper.blade.php. Using unescaped {!! json_encode(...) !!} without safe encoding flags  allows string values to break out of the JavaScript context and be interpreted as HTML/JS by the browser. If any serialized fields contain attacker-controlled content, such as a username, display name, or site config value, a malicious payload will execute arbitrary script for any user viewing the page (stored DOM XSS). This issue has been patched by commit  e28edb204e80efab628d1241198ea4f079779cfd.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jexactyl ≫ Jexactyl Version <= 3.8.0
Jexactyl ≫ Jexactyl Version 4.0.0 Update beta1
Jexactyl ≫ Jexactyl Version 4.0.0 Update beta2
Jexactyl ≫ Jexactyl Version 4.0.0 Update beta3
Jexactyl ≫ Jexactyl Version 4.0.0 Update beta4
Jexactyl ≫ Jexactyl Version 4.0.0 Update beta5
Jexactyl ≫ Jexactyl Version 4.0.0 Update beta6
Jexactyl ≫ Jexactyl Version 4.0.0 Update beta7
Jexactyl ≫ Jexactyl Version 4.0.0 Update rc1
Jexactyl ≫ Jexactyl Version 4.0.0 Update rc2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.06
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
security-advisories@github.com 5.8 0.6 5.2
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2
Vendor Advisory
Exploit
https://github.com/Jexactyl/Jexactyl/commit/e28edb204e80efab628d1241198ea4f079779cfd
Patch