{"id":"CVE-2026-75599","aliases":["EUVD-2026-117560","GHSA-h4x5-6587-jpwp"],"status":"published","title":"HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields","description":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00165,"percentile":0.05836,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-05T16:02:37Z","modified":"2026-11-05T21:32:25Z","products":[{"vendor":"sysadminsmedia","product":"homebox"}],"references":[{"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h4x5-6587-jpwp","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/sysadminsmedia/homebox/commit/d76b1c9b94e91cd74e56ef8a129325d70835471f","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75599.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75599","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-75599","title":"HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields","description":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.","status":"published","published":"2026-11-05T16:02:37.52Z","modified":"2026-11-09T22:15:20.752Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-09T23:35:22.059445Z"}],"euvd":[{"id":"EUVD-2026-117560","description":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.","status":"published","published":"2026-11-05T16:02:37Z","modified":"2026-11-09T22:15:20Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-09T23:18:32.235826Z"}],"nvd":[{"id":"CVE-2026-75599","description":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.","status":"published","published":"2026-11-05T17:18:20.34Z","modified":"2026-11-09T23:17:25.987Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-10T02:16:32.753769Z"}],"osv":[{"id":"CVE-2026-75599","title":"HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields","description":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.","status":"published","published":"2026-11-05T16:02:37.52Z","modified":"2026-11-11T02:30:47.140020727Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T03:08:10.290242Z"}]}}