Cockpit-HQ Cockpit up to 2.14.0 Display Page Template content/:models/manage interpolate cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in Cockpit-HQ Cockpit up to 2.14.0. Affected is the function interpolate of the file content/:models/manage of the component Display Page Template Handler. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-23695. It is possible to launch the attack remotely. No exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Cockpit-HQ Cockpit up to 2.14.0. It has been rated as problematic. Affected by this issue is the function interpolate of the file content/:models/manage of the component Display Page Template Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, where the template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization. An attacker with content/:models/manage permission can inject arbitrary JavaScript into the Display template, which executes in the browser of any user viewing the collection items list.

The weakness was published by D6fault and VulnCheck as 72a83fcfe85ad8330e9ae834bc02fa517b5749e9. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-23695 since 01/14/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Applying the patch 72a83fcfe85ad8330e9ae834bc02fa517b5749e9 is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cockpit-HQ

Name

• Cockpit

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14.0

License

• open-source

Website

• Product: https://github.com/Cockpit-HQ/Cockpit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion