CVE-2026-33061: exactyl Game Panel Stored XSS Vulnerability

CVE-2026-33061 Overview

CVE-2026-33061 is a stored DOM Cross-Site Scripting (XSS) vulnerability affecting Jexactyl, a customizable game management panel and billing system. The vulnerability exists in commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd, where server-side objects are improperly injected into client-side JavaScript through resources/views/templates/wrapper.blade.php. The use of unescaped {!! json_encode(...) !!} without safe encoding flags allows attacker-controlled content to break out of the JavaScript context and execute arbitrary scripts in the context of any user viewing the affected page.

Critical Impact
Attackers can inject malicious JavaScript payloads through user-controllable fields such as usernames, display names, or site configuration values, enabling stored DOM XSS attacks that execute for any user viewing the compromised page.

Affected Products

Jexactyl (commits after 025e8dbb0daaa04054276bda814d922cf4af58da)
Jexactyl (commits before e28edb204e80efab628d1241198ea4f079779cfd)

Discovery Timeline

2026-03-20 - CVE-2026-33061 published to NVD
2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-33061

Vulnerability Analysis

This vulnerability stems from improper output encoding in the Jexactyl blade template system. The affected component, resources/views/templates/wrapper.blade.php, uses Laravel's raw output syntax {!! !!} combined with json_encode() to serialize server-side objects directly into JavaScript context. Without proper encoding flags, this approach creates a dangerous scenario where string values containing special characters can escape the intended JavaScript string boundaries.

When json_encode() is called without the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags, certain characters within the serialized data can be interpreted as HTML or JavaScript by the browser rather than as literal string content. This allows attackers to inject malicious payloads that will be stored on the server and executed whenever any user loads the affected page.

The attack surface includes any user-controllable field that gets serialized and rendered through the vulnerable template, including usernames, display names, and site configuration values. Because the injected payload persists server-side and executes for all viewers, this constitutes a stored (persistent) DOM XSS vulnerability.

Root Cause

The root cause is the use of Laravel's unescaped blade output syntax {!! !!} combined with json_encode() without safe encoding flags. When serializing PHP objects containing user-controlled data to JavaScript, the absence of flags like JSON_HEX_TAG and JSON_HEX_QUOT allows special characters to break out of string literals and inject executable code into the page context.

Attack Vector

The attack requires local access with high privileges and user interaction. An attacker with administrative access to modify user profiles or site configuration values can inject a malicious JavaScript payload into a field that gets serialized through the vulnerable template. When any user views a page that renders this data, the payload executes in their browser context, potentially allowing session hijacking, credential theft, or further privilege escalation.

The vulnerability mechanism involves the improper encoding in the blade template. When json_encode() outputs values containing characters like </script> or string terminators, these can close the existing script context and inject new executable code. For detailed technical analysis, refer to the GitHub Security Advisory GHSA-6xgw-mmmv-57h2.

Detection Methods for CVE-2026-33061

Indicators of Compromise

Unexpected JavaScript execution in browser developer console when viewing Jexactyl pages
User profile fields or site configuration values containing suspicious HTML/JavaScript tags
Unusual session activity or authentication events from legitimate user sessions
Client-side errors indicating script injection attempts in application logs

Detection Strategies

Review user-controllable fields (usernames, display names, site config values) for embedded script tags or JavaScript event handlers
Monitor Content Security Policy (CSP) violation reports for inline script execution attempts
Implement server-side logging to track modifications to profile and configuration fields
Deploy web application firewalls with rules to detect XSS payload patterns in input fields

Monitoring Recommendations

Enable browser-based XSS detection headers and monitor for triggered alerts
Implement real-time monitoring of administrative configuration changes
Review application logs for unusual profile update patterns or bulk modifications
Deploy endpoint detection to identify unauthorized script execution in user browsers

How to Mitigate CVE-2026-33061

Immediate Actions Required

Update Jexactyl to commit e28edb204e80efab628d1241198ea4f079779cfd or later immediately
Review all user profile fields and site configuration values for potentially malicious content
Implement Content Security Policy (CSP) headers to restrict inline script execution
Audit administrative account access and rotate credentials if compromise is suspected

Patch Information

The vulnerability has been patched in commit e28edb204e80efab628d1241198ea4f079779cfd. The fix addresses the unsafe json_encode() usage by implementing proper encoding flags that prevent special characters from escaping the JavaScript context. Organizations running affected versions should update immediately by pulling the latest commits from the Jexactyl repository. For patch details, see the GitHub commit.

Workarounds

Manually modify resources/views/templates/wrapper.blade.php to use json_encode() with JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP flags
Implement strict Content Security Policy headers to block inline script execution
Restrict administrative access to trusted users only until the patch can be applied
Enable input validation on all user-controllable fields to reject HTML/JavaScript content

bash

# Content Security Policy header configuration for nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none';" always;