CVE-2026-60119: Hi.Events XSS Vulnerability

CVE-2026-60119 Overview

CVE-2026-60119 is a stored cross-site scripting (XSS) vulnerability in Hi.Events versions prior to 1.11.0. Authenticated attackers with event creation or edit permissions can inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence. The payload is not escaped by JSON.stringify() when embedded in inline <script> tags, allowing attackers to break out of the script context. The injection occurs in the application/ld+json structured data block and server-side rehydrated state. Any user viewing the public event page, including unauthenticated visitors and administrators, executes the payload in their browser.

Critical Impact
Stored XSS enables session hijacking and administrative account compromise through any public event page view.

Affected Products

Hi.Events versions before 1.11.0
Hi.Events event management platform (self-hosted deployments)
Public-facing event pages rendering server-side JSON state

Discovery Timeline

2026-07-14 - CVE-2026-60119 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-60119

Vulnerability Analysis

The vulnerability stems from unsafe embedding of user-controlled event titles into inline <script> tags. Hi.Events serializes event metadata using PHP-side JSON encoding and injects the output into two contexts: an application/ld+json structured data block for search engine optimization, and a server-side rehydrated state object consumed by the frontend. JavaScript's JSON.stringify() escapes quotes and backslashes but does not escape the string </script>. When an attacker sets an event title containing this sequence, the browser HTML parser terminates the enclosing script element early and interprets the remaining content as new markup, enabling arbitrary script execution [CWE-862].

Root Cause

The root cause is missing output encoding for HTML-sensitive characters when serialized JSON is embedded inside an HTML script context. String data safe for JSON parsers is not automatically safe for HTML tokenizers. Sequences such as </script>, U+2028, and U+2029 must be escaped separately before rendering.

Attack Vector

An authenticated user with event edit permissions creates or updates an event with a title such as Concert</script><script>alert(document.cookie)</script>. When any visitor loads the public event page, the injected script executes with the origin of the Hi.Events deployment. The payload can exfiltrate session cookies, perform actions as authenticated administrators, or pivot to further attacks against the application.

php

// Security patch: backend/app/Helper/StringHelper.php
class StringHelper
{
    /**
     * Remove control characters and unicode line/paragraph separators from a plain-text value.
     */
    public static function stripControlCharacters(string $text): string
    {
        return preg_replace('/[\x{0000}-\x{001F}\x{007F}-\x{009F}\x{2028}\x{2029}]/u', '', $text) ?? $text;
    }

    public static function previewFromHtml(string $text, int $length = 100): string
    {
        $textWithSpaces = preg_replace('/<[^>]+>/', ' ', $text);

Source: GitHub Commit 1e36b07

The patch introduces stripControlCharacters() to strip control characters and Unicode line separators (U+2028, U+2029) from plain-text values. UpdateEventHandler.php is modified to import and apply the helper to event titles before persistence.

Detection Methods for CVE-2026-60119

Indicators of Compromise

Event records containing the substring </script>, <script, or HTML tags in the title field
Presence of Unicode separators U+2028 or U+2029 within event metadata fields
Anomalous outbound requests from browser sessions viewing event pages, indicating cookie or token exfiltration
Unexpected administrative actions performed via authenticated admin sessions shortly after viewing an event page

Detection Strategies

Query the Hi.Events database for event titles containing <, >, or the literal string script and review for injection attempts
Monitor web server access logs for repeated PUT or POST requests to event update endpoints from newly created accounts
Deploy Content Security Policy (CSP) reporting to flag inline script execution violations on public event pages

Monitoring Recommendations

Enable audit logging on event creation and edit endpoints and alert on titles exceeding expected length or containing HTML metacharacters
Instrument frontend telemetry to detect unexpected script loads or DOM mutations on event pages
Review recent event edits performed by non-administrator accounts for suspicious title values

How to Mitigate CVE-2026-60119

Immediate Actions Required

Upgrade Hi.Events to version 1.11.0 or later, which includes the fix from pull request #1260
Audit all existing event titles for HTML metacharacters and the </script> sequence and sanitize offending records
Restrict event creation and edit permissions to trusted users until the patch is applied
Rotate administrative session tokens if suspicious event edits are discovered

Patch Information

The fix is available in commit 1e36b07 and released in v1.11.0-beta. See the GitHub Security Advisory GHSA-2ggx-79g6-2jmj, the GitHub Pull Request #1260, and the VulnCheck Advisory for full technical details.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts to reduce the impact of injected payloads
Place a web application firewall rule in front of Hi.Events to block event update requests containing </script> in the title field
Temporarily disable public event pages if upgrading is not immediately possible

bash

# Example CSP header to limit inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';";