sergejey MajorDoMo /objects/?method say cross site scripting

Summaryinfo

A vulnerability was found in sergejey MajorDoMo. It has been classified as problematic. This affects the function say of the file /objects/?method. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026-27178. The attack may be initiated remotely. There is no available exploit. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in sergejey MajorDoMo (unknown version). This issue affects the function say of the file /objects/?method. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default methods such as ThisComputer.VolumeLevelChanged pass the user-supplied VALUE parameter directly into the say() function, which stores the message raw in the shouts database table without escaping. The shoutbox widget renders stored messages without sanitization in both PHP rendering code and HTML templates. Because the dashboard widget auto-refreshes every 3 seconds, the injected script executes automatically when any administrator loads the dashboard, enabling session hijack through cookie exfiltration.

The weakness was presented by Valentin Lobstein. The advisory is shared at chocapikk.com. The identification of this vulnerability is CVE-2026-27178 since 02/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• sergejey

Name

• MajorDoMo

Website

• Product: https://github.com/sergejey/majordomo/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion