CVE-2026-90821: Crafty Controller XSS Vulnerability

CVE-2026-90821 Overview

CVE-2026-90821 is a stored cross-site scripting (XSS) vulnerability in the Webhook URL form field component of Crafty Controller, a web-based Minecraft server management application. The flaw stems from improper neutralization of user-supplied input [CWE-79]. An authenticated remote attacker can inject malicious script content through the Webhook URL field, which the application later renders in other users' browsers. Successful exploitation enables script execution in the context of any user who views the affected interface.

Critical Impact
Authenticated attackers can store JavaScript payloads that execute in other users' browsers, enabling session theft, UI manipulation, and privileged action abuse within the Crafty Controller interface.

Affected Products

Crafty Controller (crafty-4) — Webhook URL form field component

Discovery Timeline

2026-10-16 - CVE CVE-2026-90821 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-90821

Vulnerability Analysis

The vulnerability resides in the Webhook URL form field used to configure outbound notifications in Crafty Controller. The application accepts the webhook URL value from an authenticated user and persists it to storage without applying output encoding or input sanitization. When the stored value is later rendered in the web interface, embedded script content executes within the viewer's browser session.

Because the payload is persisted server-side, every subsequent page load that includes the webhook configuration triggers execution. The scope-changed property in the vector indicates the injected script can affect resources beyond the vulnerable component's immediate security boundary, including other authenticated sessions. User interaction is required, meaning a victim must view the page that renders the stored payload.

The underlying weakness is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation. Refer to the GitLab Work Item #745 for maintainer tracking.

Root Cause

The Webhook URL field lacks server-side validation to ensure the stored value conforms to a URL grammar. The field also lacks context-appropriate HTML output encoding when rendered back into the dashboard. The combination allows arbitrary HTML and JavaScript to persist and execute.

Attack Vector

An authenticated attacker with permission to create or modify webhook configurations submits a payload containing HTML or JavaScript in the Webhook URL field. The payload is stored. When another authenticated user — including an administrator — navigates to a view that renders the webhook configuration, the browser executes the payload under the application's origin.

The vulnerability requires network access, low privileges, low attack complexity, and user interaction. See the GitLab Work Item #745 for technical details.

Detection Methods for CVE-2026-90821

Indicators of Compromise

Webhook configuration entries containing HTML tags, javascript: URIs, or script delimiters such as <script>, onerror=, or onload=.
Unexpected outbound requests from browsers of users viewing the Crafty Controller dashboard.
Session anomalies, including token reuse from unfamiliar IP addresses, following administrator access to the webhook settings page.

Detection Strategies

Audit the Crafty Controller database and configuration store for webhook URL values that do not match a strict URL pattern (^https?://).
Review web server access logs for POST requests to webhook configuration endpoints containing encoded script payloads.
Enable browser Content Security Policy (CSP) violation reporting to surface attempts to execute inline or external scripts from the dashboard origin.

Monitoring Recommendations

Monitor authenticated user activity for creation or modification of webhook entries by low-privilege accounts.
Alert on administrator session cookies observed from new user agents or geographies shortly after webhook configuration pages are accessed.
Correlate dashboard access events with outbound DNS or HTTP requests to unfamiliar domains that may indicate payload exfiltration.

How to Mitigate CVE-2026-90821

Immediate Actions Required

Restrict webhook configuration permissions to trusted administrators until a fixed version is deployed.
Inspect existing webhook entries for stored script content and remove any entries that do not resolve to a valid HTTP or HTTPS URL.
Rotate session tokens and administrator credentials if evidence of exploitation is identified.

Patch Information

Monitor the Crafty Controller GitLab project for the official fix. Apply the patched release as soon as it becomes available and verify that user-supplied webhook URLs are validated server-side and HTML-encoded on output.

Workarounds

Place Crafty Controller behind a reverse proxy that enforces a strict Content Security Policy disallowing inline scripts.
Limit the roles permitted to create or edit webhook configurations to a minimum set of operators.
Deploy a web application firewall rule that blocks requests to the webhook configuration endpoint when the URL field contains angle brackets or javascript: schemes.

bash

# Example nginx Content Security Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;