CVE-2026-23695: Cockpit CMS Stored XSS Vulnerability

CVE-2026-23695 Overview

CVE-2026-23695 is a stored cross-site scripting (XSS) vulnerability in Cockpit CMS through version 2.14.0. The flaw resides in the Set field type's Display template option, where the template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization. An attacker holding the content/:models/manage permission can inject arbitrary JavaScript into the Display template. The payload executes in the browser of any user viewing the collection items list. The issue is tracked under [CWE-79] and was patched in commit 72a83fc.

Critical Impact
Authenticated users with content model management permissions can inject persistent JavaScript that executes against any administrator browsing the affected collection.

Affected Products

Cockpit CMS versions through 2.14.0
Cockpit CMS Set field type Display template option
Cockpit CMS instances exposing the content/:models/manage permission to non-administrators

Discovery Timeline

2026-05-15 - CVE-2026-23695 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-23695

Vulnerability Analysis

The vulnerability stems from unsafe template evaluation in the Cockpit CMS admin interface. The App.utils.$interpolate helper compiles the user-supplied Display template string into executable JavaScript using new Function(). The resulting markup is then rendered through Vue's v-html directive, which bypasses standard HTML escaping. Because the Display template is stored as part of the field definition, the injected payload persists in the database and re-executes for every user that loads the collection items list. The attack falls under [CWE-79], stored cross-site scripting.

Root Cause

The root cause is the combination of two unsafe primitives. First, $interpolate evaluates template strings through the Function constructor, providing a JavaScript execution sink. Second, the output is bound with v-html, removing Vue's built-in output encoding. No sanitization or allow-listing is applied to the template input, so any script content supplied by a user with model-management rights is preserved and rendered.

Attack Vector

An authenticated attacker with content/:models/manage permission edits a Set field and supplies a malicious Display template containing JavaScript. When another user, typically an administrator, navigates to the collection items list, the template is interpolated and inserted into the DOM via v-html. The attacker's script then executes in the victim's session, enabling session token theft, CSRF-style admin actions, or pivoting to higher-privileged accounts.

javascript

// Security patch from commit 72a83fc - modules/App/assets/js/app/utils.js
// Replaces App.utils.$interpolate / App.utils.interpolate Function-based eval
+import { Engine as JSLiteEngine } from "../../vendor/jslite.esm.js";
+
 let formatSize = function(bytes) {
     if (bytes == 0) { return "0.00 B"; }
     let e = Math.floor(Math.log(bytes) / Math.log(1024));
// Source: https://github.com/Cockpit-HQ/Cockpit/commit/72a83fcfe85ad8330e9ae834bc02fa517b5749e9

The fix replaces the Function-based evaluator with the JSLiteEngine sandboxed expression engine, removing the arbitrary code execution sink.

Detection Methods for CVE-2026-23695

Indicators of Compromise

Set field definitions containing <script>, onerror=, onload=, or other event handler attributes inside the Display template value.
Unexpected modifications to content model JSON definitions in the Cockpit storage backend.
Admin-session web requests originating immediately after an admin loads a collection items list.

Detection Strategies

Audit stored content model definitions for Display template strings that contain JavaScript syntax such as ${, Function(, or HTML tags.
Enable Content Security Policy (CSP) reporting and review violations triggered by inline script execution in the Cockpit admin UI.
Review Cockpit access logs for accounts with content/:models/manage permission that recently modified Set field configurations.

Monitoring Recommendations

Monitor changes to the collections and models storage for non-administrator users editing field templates.
Alert on outbound requests from admin browser sessions to unexpected destinations following access to /admin/content/collection/entries.
Track privilege grants of content/:models/manage and review whether the role is required for each assigned user.

How to Mitigate CVE-2026-23695

Immediate Actions Required

Upgrade Cockpit CMS to the version containing commit 72a83fc or later.
Audit existing Set field Display templates and remove any entries containing scripts or HTML event handlers.
Restrict content/:models/manage permission to fully trusted administrators only.

Patch Information

The vendor fix is published in Cockpit-HQ commit 72a83fc, which replaces the Function-based $interpolate evaluator with the sandboxed JSLiteEngine. Additional context is available in the VulnCheck Security Advisory.

Workarounds

Revoke content/:models/manage permission from non-administrator roles until patched builds are deployed.
Apply a strict Content Security Policy that blocks inline script execution in the Cockpit admin UI.
Manually sanitize stored Display template values to remove HTML and JavaScript constructs.

bash

# Search existing Cockpit storage for suspicious Display templates
grep -rEi '"display"\s*:\s*".*(<script|onerror=|onload=|javascript:).*"' \
  /path/to/cockpit/storage/data/collections/ \
  /path/to/cockpit/storage/data/models/