CVE-2026-45627
- Source
- https://cve.org/CVERecord?id=CVE-2026-45627
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45627.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-45627
- Aliases
- Published
- 2026-05-29T17:08:53.797Z
- Modified
- 2026-07-08T08:13:29.913103753Z
- Severity
-
- 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
- Summary
- Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover
- Details
-
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> element of the embedded logo.svg, allowing an attacker to close the style block and inject executable <script> content. Because the response is served as image/svg+xml and Arcane sets no Content-Security-Policy or X-Content-Type-Options headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account. This vulnerability is fixed in 1.19.0.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45627.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ] }- References