CVE-2026-65697

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-65697

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65697.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-65697

Published

2026-07-23T16:29:20.087Z

Modified

2026-08-12T03:51:49.299845216Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Details

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint. The parseHostname and parsePathname functions perform no URI scheme validation, allowing a javascript: hostname combined with a newline-prefixed pathname to be stored and later rendered as an anchor href in the authenticated dashboard without sanitization, enabling session hijacking and full account takeover when an operator clicks the poisoned entry.

Database specific

{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65697.json",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/usefathom/fathom

Affected ranges

Type

GIT

Repo

https://github.com/usefathom/fathom

Events

Introduced

Last affected

b252c743cc1ef1979f351ab77f99b2ae4aba9aa9

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.3.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.0.1

1.1.0

1.1.1

v1.*

v1.2.0

v1.2.1

v1.3.0

v1.3.0-rc.1

v1.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65697.json"