CVE-2026-45560: Roxy-WI Web Interface XSS Vulnerability

CVE-2026-45560 Overview

CVE-2026-45560 is a stored Cross-Site Scripting (XSS) vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw affects versions 8.2.6.4 and prior. The wrap_line and highlight_word functions in app/modules/common/common.py build raw HTML through string concatenation without escaping. The frontend log viewer injects these strings using jQuery .html(data) and .append(data), executing attacker-controlled markup. Any unauthenticated user who can send HTTP requests to a managed load balancer can inject a payload into the access log that fires when a Roxy-WI administrator opens the log viewer [CWE-79].

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session by writing crafted entries to a managed HAProxy or Nginx access log.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
Deployments exposing HAProxy or Nginx logs to the Roxy-WI log viewer
Roxy-WI administrators viewing logs from internet-facing load balancers

Discovery Timeline

2026-06-10 - CVE-2026-45560 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45560

Vulnerability Analysis

The vulnerability resides in two helper functions in app/modules/common/common.py. The wrap_line function (lines 181-186) and highlight_word function (lines 188-192) construct HTML output by concatenating user-controlled log content directly into markup strings. Neither function applies HTML entity encoding or output escaping.

The Roxy-WI frontend in app/static/js/script.js consumes the server response on log-viewer paths and inserts it into the DOM via jQuery .html(data) and .append(data). Both sinks parse and execute any embedded <script> tags or DOM event handlers contained in the response.

The result is a stored XSS chain in which the storage medium is the access log of the managed web server itself. The attack surface extends to anyone who can reach the public load balancer.

Root Cause

The root cause is missing output encoding in server-side HTML generation combined with an unsafe DOM sink on the client. User-controlled bytes from request headers, URIs, and User-Agent strings flow from the HAProxy or Nginx access log through wrap_line and highlight_word and into the administrator browser without sanitization.

Attack Vector

An attacker sends an HTTP request to a managed HAProxy or Nginx instance containing an XSS payload such as <svg/onload=...> in a logged field. HAProxy or Nginx writes the payload verbatim to its access log. When a Roxy-WI administrator opens the log viewer, the payload is rendered as HTML and the JavaScript executes with the administrator's session context.

Exploitation requires no authentication on the attacker side and only one administrator interaction with the log viewer. See the GitHub Security Advisory GHSA-28m4-mmr2-83p6 for technical references.

Detection Methods for CVE-2026-45560

Indicators of Compromise

Access log entries containing HTML or JavaScript tokens such as <svg, <script, onload=, onerror=, or javascript: in request paths, headers, or User-Agent fields
Unusual outbound requests from administrator workstations shortly after log viewer access
Unexpected session token or cookie exfiltration patterns from Roxy-WI hosts
New or modified Roxy-WI user accounts following administrator log review sessions

Detection Strategies

Inspect HAProxy and Nginx access logs for raw HTML control characters and event-handler attributes
Monitor browser-side telemetry for script execution originating from Roxy-WI log viewer pages
Correlate inbound requests carrying suspicious payload markers with subsequent administrator log views

Monitoring Recommendations

Forward HAProxy, Nginx, and Roxy-WI application logs to a centralized analytics platform for pattern matching
Alert on access log entries containing angle brackets in fields that should only carry tokens or URIs
Track administrator browser sessions for anomalous DOM activity on /logs or log-viewer endpoints

How to Mitigate CVE-2026-45560

Immediate Actions Required

Restrict access to the Roxy-WI web interface to trusted administrative networks only
Avoid opening the Roxy-WI log viewer for logs sourced from internet-facing load balancers until a patch is available
Configure HAProxy and Nginx to reject or sanitize requests containing raw HTML metacharacters in headers and paths
Review existing logs for embedded payloads before viewing them through the Roxy-WI UI

Patch Information

At the time of publication, no patched release of Roxy-WI is available. Track the GitHub Security Advisory GHSA-28m4-mmr2-83p6 for updates and apply the fixed version as soon as the maintainers publish it.

Workarounds

Use a strict Content Security Policy on the Roxy-WI virtual host to block inline script execution
Deploy a reverse proxy or web application firewall in front of managed load balancers to drop requests containing HTML tag characters in non-body fields
Inspect log files with a plain text viewer outside the Roxy-WI UI until the issue is patched

bash

# Example Nginx WAF-style filter to drop obvious XSS payloads before logging
if ($request_uri ~* "(<svg|<script|onload=|onerror=|javascript:)") {
    return 400;
}