CVE-2026-82838: Venueless Docker Image XSS Vulnerability

CVE-2026-82838 Overview

CVE-2026-82838 affects the default Docker image shipped for Venueless, an open-source event platform. The image did not properly restrict how uploaded Scalable Vector Graphics (SVG) files were served to end users. SVG files could be delivered with executable JavaScript content, enabling stored cross-site scripting (XSS) attacks against other users of the platform. The maintainers addressed the issue by configuring a valid Content Security Policy (CSP). The vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.

Critical Impact
An authenticated attacker who uploads a crafted SVG file can execute arbitrary JavaScript in the browser context of any user that views the file, leading to session compromise and account takeover.

Affected Products

Venueless (default Docker image distribution)
Deployments that rely on the bundled web server configuration for serving user uploads
Instances that permit user-supplied SVG uploads without an external Content Security Policy

Discovery Timeline

2026-08-31 - CVE-2026-82838 published to the National Vulnerability Database
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-82838

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw introduced by the default Venueless Docker image. SVG is an XML-based image format that natively supports embedded <script> tags and JavaScript event handlers. When a web server returns an SVG file with a Content-Type of image/svg+xml and no restrictive Content Security Policy, browsers execute any script contained inside the file in the origin of the serving host.

Venueless allows authenticated users to upload files, including profile assets and event media. The shipped container did not send a Content Security Policy header on responses that delivered uploaded content. As a result, any SVG containing scripting constructs was rendered as active content when opened directly or embedded through an <iframe> or <object> tag.

Root Cause

The root cause is a missing hardening control in the default reverse proxy and application configuration bundled with the Docker image. Serving user-controlled SVG files from the same origin as the application, without a CSP that disables inline script execution or forces a safe Content-Disposition, permits script execution. The upstream fix introduces a valid Content Security Policy that constrains script sources on responses serving uploaded assets.

Attack Vector

Exploitation requires an attacker to hold a low-privileged authenticated account and to convince a victim to open or preview the malicious file. The attacker uploads an SVG containing a <script> element or an inline event handler such as onload. When another user views the uploaded resource in the application, the browser evaluates the embedded JavaScript in the Venueless origin. The script can then read session data, perform actions on behalf of the victim, or pivot to other in-scope endpoints. Refer to the GitHub Security Advisory GHSA-38wh-hqvm-xgfc for advisory details.

Detection Methods for CVE-2026-82838

Indicators of Compromise

Uploaded files with the .svg extension whose contents include <script>, javascript:, or DOM event handler attributes such as onload= or onerror=.
HTTP responses from the Venueless upload path returning Content-Type: image/svg+xml without a Content-Security-Policy header.
Unexpected outbound requests from user browsers to attacker-controlled hosts shortly after opening a Venueless attachment.

Detection Strategies

Scan the upload storage volume for SVG files containing scripting constructs using pattern matching on <script, on\w+=, and javascript: URIs.
Inspect reverse proxy access logs for GET requests to media paths that immediately precede anomalous authenticated API calls from the same session.
Compare running container response headers against the patched configuration to confirm the presence of a valid CSP.

Monitoring Recommendations

Enable browser-side reporting via the Content-Security-Policy-Report-Only directive to surface script execution attempts from uploaded assets.
Forward web server and application logs to a centralized analytics platform and alert on high-volume SVG retrievals from a single account.
Track new file uploads by user, file type, and MIME sniffing outcomes to identify accounts probing the upload pipeline.

How to Mitigate CVE-2026-82838

Immediate Actions Required

Update the Venueless Docker image to the release that ships the corrected Content Security Policy configuration.
Audit existing uploads for SVG files containing <script> tags or JavaScript event handlers and quarantine suspect files.
Rotate active session tokens and API keys if evidence of SVG-based script execution is present in logs.

Patch Information

The Venueless maintainers resolved the issue by setting a valid Content Security Policy in the default Docker image. Consult the GitHub Security Advisory GHSA-38wh-hqvm-xgfc for the fixed version and upgrade instructions.

Workarounds

Place uploaded SVG files behind a reverse proxy that sets Content-Security-Policy: default-src 'none'; script-src 'none'; style-src 'unsafe-inline' on the media path.
Force downloads of user-supplied SVGs by returning Content-Disposition: attachment and serving them from an isolated origin.
Convert uploaded SVG files to raster formats such as PNG on the server side before storing them for delivery.

bash

# Example nginx snippet to harden the Venueless media location
location /media/ {
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'; style-src 'unsafe-inline'; img-src 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Disposition "attachment" always;
}