CVE-2026-71285 in Uptime Kuma
Summary
by MITRE • 08/05/2026
Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo `siteId` value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page: `_paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);`. The escaping pipeline used (jsesc with isScriptContext:true, then html-escaper.escape()) does not escape the characters `]`, `)`, `;`, `(`, which are sufficient to break out of the array/push expression context. A siteId value such as `1]);alert(document.cookie)//`, once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability resides in Uptime Kuma's Matomo analytics integration where the application fails to properly sanitize user-provided configuration values before injecting them into JavaScript contexts within HTML documents. This represents a classic cross-site scripting flaw that occurs when untrusted data flows directly into executable code without adequate sanitization. The specific implementation involves the server/analytics/matomo-analytics.js file which processes admin-configurable siteId parameters and injects them as bare JavaScript expressions within script blocks rendered on public status pages. The injection point is located in the _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]) expression where the escaping mechanism proves insufficient against certain character sequences.
The technical flaw stems from inadequate input validation and sanitization within the escaping pipeline used by Uptime Kuma's analytics module. While the system employs jsesc with isScriptContext:true followed by html-escaper.escape(), this combination fails to escape critical JavaScript metacharacters including ], ), ;, and (. These characters are sufficient to break out of the array expression context and execute arbitrary JavaScript code within the victim's browser session. The vulnerability specifically exploits the fact that the escaping process does not account for JavaScript context boundaries, allowing attackers to inject malicious payloads that terminate the existing array expression and introduce new executable statements. When an administrator saves a malicious siteId value such as `1]);alert(document.cookie)//`, the payload executes within the context of every public status page visit.
The operational impact of this vulnerability is severe and far-reaching for any Uptime Kuma deployment utilizing Matomo analytics. Every unauthenticated visitor to the public /status/ page becomes a potential victim of session hijacking attacks, as the malicious JavaScript code can steal session cookies and other sensitive browser data. This creates a persistent threat vector that affects all users accessing public status pages without authentication, effectively enabling full takeover of the affected service's administrative capabilities. The vulnerability essentially transforms any Uptime Kuma instance with public status pages into an open attack surface for credential theft and unauthorized access attempts. Attackers can leverage this to execute arbitrary commands within the browser context, potentially leading to complete compromise of the monitoring system.
The vulnerability aligns with CWE-79 Cross-Site Scripting and CWE-116 Improper Encoding or Escaping of Output, specifically manifesting as a server-side code injection where user input flows directly into executable JavaScript contexts. From an ATT&CK framework perspective, this represents T1531 Account Access Removal through session hijacking, combined with T1071.004 Application Layer Protocol: DNS for potential command and control communications if the malicious payload includes network exfiltration capabilities. The exploitation requires minimal privileges since it only necessitates administrative access to modify the siteId configuration parameter. Mitigation strategies should include implementing strict input validation that prevents JavaScript metacharacters from entering the configuration system, enforcing proper context-aware escaping for all dynamic JavaScript injection points, and considering a complete redesign of the analytics integration to avoid inline script injection entirely. Organizations should also implement monitoring for unusual configuration changes and consider rate limiting or authentication requirements for analytics configuration modifications.
The root cause analysis reveals that this vulnerability results from insufficient understanding of context-specific escaping requirements in web application security. The developers likely assumed that HTML escaping would be sufficient for JavaScript contexts, failing to recognize that different execution contexts require different sanitization approaches. This type of vulnerability commonly occurs when security measures are applied in isolation rather than considering the complete data flow through multiple transformation layers. The issue demonstrates how seemingly innocuous configuration parameters can become attack vectors when proper input validation and context-aware escaping mechanisms are not implemented. Organizations should implement comprehensive security testing that includes dynamic analysis of all user-controlled inputs within JavaScript contexts, particularly focusing on injection points where configuration values are rendered into executable code.