CVE-2026-90502: stilleshan ServerStatus XSS Vulnerability

CVE-2026-90502 Overview

CVE-2026-90502 is a stored cross-site scripting [CWE-79] vulnerability in stilleshan ServerStatus versions 1.0 and 2.0. The flaw resides in an unspecified function within the server/src/main.cpp file, part of the Stats Generation component. Attackers can manipulate the custom argument to inject arbitrary script content that executes in the browser of any user viewing the affected statistics page. The exploit is publicly available. According to the disclosure record, the vendor was contacted but did not respond.

Critical Impact
Remote authenticated attackers can inject persistent JavaScript through the custom parameter, enabling session theft, credential harvesting, and unauthorized actions against ServerStatus dashboard users.

Affected Products

stilleshan ServerStatus 1.0
stilleshan ServerStatus 2.0
Stats Generation component (server/src/main.cpp)

Discovery Timeline

2026-09-13 - CVE-2026-90502 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90502

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the ServerStatus stats generation logic. User-controlled input passed through the custom argument is written into server-rendered output without proper encoding or sanitization. When another user loads the affected dashboard view, the injected payload executes in the context of that user's session.

Exploitation requires network access and low-privileged authentication, and the attack path involves user interaction with the compromised view. Impact is limited to integrity of the rendered content, though script execution enables cookie theft, dashboard defacement, and pivoting to further application abuse. See the VulDB entry for CVE-2026-90502 for additional context.

Root Cause

The root cause is missing output encoding of the custom parameter in the C++ statistics generation path within server/src/main.cpp. The application concatenates untrusted input into HTML output served by the ServerStatus web frontend. Because the payload persists in server state and is rendered to subsequent viewers, this is a stored rather than reflected variant of [CWE-79].

Attack Vector

A remote attacker with a valid low-privileged account submits a crafted value for the custom argument through the ServerStatus interface. The malicious payload is stored server-side and delivered to any user who loads the affected stats view. The attack requires the victim to view the poisoned dashboard, satisfying the user interaction requirement.

No verified proof-of-concept code is republished here. Refer to the GitHub PoC documentation referenced in the advisory for reproduction details.

Detection Methods for CVE-2026-90502

Indicators of Compromise

HTTP requests to ServerStatus endpoints containing custom parameter values with <script>, onerror=, onload=, or javascript: substrings.
Unexpected outbound requests from browser sessions of users who accessed the ServerStatus dashboard.
Modified stats records in the ServerStatus backend containing HTML or JavaScript tags in the custom field.

Detection Strategies

Deploy a web application firewall rule that inspects custom parameter submissions to ServerStatus for HTML tags and JavaScript event handlers.
Review application logs for POST or update requests to stats endpoints containing encoded angle brackets (%3C, %3E) or URL-encoded script tokens.
Correlate authenticated ServerStatus sessions with anomalous browser telemetry such as unexpected DOM modifications or credential form activity.

Monitoring Recommendations

Enable verbose access logging on the ServerStatus web frontend and forward logs to a central analytics platform for retention and query.
Alert on any stored custom field content that contains non-alphanumeric characters outside an approved allowlist.
Track user-agent and referrer anomalies for administrators loading dashboards after a suspicious update event.

How to Mitigate CVE-2026-90502

Immediate Actions Required

Restrict network exposure of the ServerStatus dashboard to trusted management networks or VPN clients only.
Audit existing stored custom values in the ServerStatus database and purge entries containing HTML or script content.
Rotate session cookies and administrator credentials for accounts that accessed the dashboard after the publication date.

Patch Information

No vendor patch has been published at the time of writing. The disclosure record indicates the vendor did not respond to the security notification. Monitor the stilleshan ServerStatus repository and the VulDB advisory for updates on an official fix.

Workarounds

Place ServerStatus behind a reverse proxy that strips or encodes HTML metacharacters in the custom parameter before forwarding requests.
Enforce a strict Content Security Policy that disables inline script execution on ServerStatus dashboard pages.
Limit account creation and privileges so only trusted operators can submit stats data containing a custom field.
Consider migrating to an alternative monitoring stack until a vendor-supplied fix is available.

bash

# Example reverse-proxy header enforcing a restrictive Content Security Policy
# Place in the nginx server block fronting ServerStatus
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;