CVE-2026-55879: OpenReplay Session Replay XSS Vulnerability

CVE-2026-55879 Overview

CVE-2026-55879 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in OpenReplay, a self-hosted session replay suite. The OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key. The backend stores this input in ClickHouse without output encoding. The authenticated dashboard later renders the values through the TextEllipsis component and the event-details modal, executing attacker-controlled script in the dashboard origin. The flaw affects versions from 1.24.0 before 1.25.0 and is fixed in 1.25.0.

Critical Impact
An unauthenticated attacker can inject persistent JavaScript that executes in the dashboard, read the session JWT from localStorage, and take over authenticated dashboard accounts.

Affected Products

OpenReplay 1.24.0
OpenReplay versions between 1.24.0 and 1.25.0
OpenReplay tracking SDK and analytics backend

Discovery Timeline

2026-07-10 - CVE-2026-55879 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55879

Vulnerability Analysis

OpenReplay ingests telemetry from any visitor loading the tracking SDK with a public project key. Custom event names and captured page URLs are attacker-controllable inputs. The analytics backend persists these fields to ClickHouse without sanitizing HTML metacharacters. When a dashboard user opens the events view, the frontend renders these fields through the TextEllipsis component and the event-details modal without escaping.

The result is a stored XSS primitive that runs script in the authenticated dashboard origin. The injected script reads the session JWT from localStorage and exfiltrates it to an attacker-controlled endpoint, allowing full session hijack of any dashboard user who views the poisoned events.

Root Cause

The root cause is missing output encoding on event read paths in the analytics service. The patch centralizes sanitization by introducing a sanitizer package and invoking entry.SanitizeForHTML() before events are returned to the dashboard.

Attack Vector

The attack requires no authentication. An attacker loads the OpenReplay tracking SDK against a target project using the public project key, then emits a custom event whose name contains an HTML payload, or navigates to a URL crafted to embed script markup. When any authenticated dashboard user later views sessions or events, the payload executes.

// Patch: backend/pkg/analytics/events/events.go
// Applies HTML-safe encoding before events reach the dashboard
            continue
        }

+       entry.SanitizeForHTML()
+
        events = append(events, entry)
    }

Source: GitHub Commit ec41f44

// Patch: backend/pkg/analytics/events/model/event.go
// Imports the new centralized sanitizer package

import (
    "openreplay/backend/pkg/analytics/filters"
+   "openreplay/backend/pkg/analytics/sanitizer"
)

Source: GitHub Commit ec41f44

Detection Methods for CVE-2026-55879

Indicators of Compromise

Custom event names or captured URLs in ClickHouse containing <script, onerror=, onload=, or javascript: substrings.
Outbound requests from dashboard user browsers to unfamiliar domains carrying JWT-shaped strings in query or body parameters.
Dashboard sessions authenticating from new IPs or user agents shortly after event views.

Detection Strategies

Query ClickHouse event and page tables for HTML metacharacters (<, >, ", ') in event_name and url columns.
Inspect Content Security Policy violation reports from the dashboard origin for inline script blocks.
Review web proxy logs for tracking SDK ingest requests containing script markup in event payloads.

Monitoring Recommendations

Alert on anomalous dashboard API activity following event-list or event-details rendering.
Monitor for unusual localStorage access patterns and JWT usage from geographies or clients that differ from the account owner.
Track OpenReplay version strings across deployments to confirm all instances are at 1.25.0 or later.

How to Mitigate CVE-2026-55879

Immediate Actions Required

Upgrade all OpenReplay deployments to version 1.25.0 immediately.
Invalidate existing dashboard sessions and rotate JWT signing keys to void any tokens that may have been exfiltrated.
Audit ClickHouse event tables for stored payloads and purge malicious rows before restoring dashboard access.

Patch Information

The fix is included in OpenReplay v1.25.0. The relevant code change is tracked in commit ec41f44 and documented in the GHSA-3mfc-7hf4-jfxh advisory. The patch introduces a centralized sanitizer package and calls SanitizeForHTML() on event entries before they are returned to the dashboard.

Workarounds

Restrict dashboard access to trusted networks until the upgrade is applied.
Rotate public project keys and consider temporarily disabling ingestion from untrusted origins.
Deploy a strict Content Security Policy on the dashboard origin that blocks inline script execution.

bash

# Verify the installed OpenReplay version and upgrade if below 1.25.0
git -C /opt/openreplay describe --tags
helm upgrade openreplay openreplay/openreplay --version 1.25.0