GHSA-x397-5hrv-j9m9

Suggest an improvement
Source
https://github.com/advisories/GHSA-x397-5hrv-j9m9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x397-5hrv-j9m9/GHSA-x397-5hrv-j9m9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-x397-5hrv-j9m9
Aliases
  • CVE-2026-113712
Published
2026-10-20T21:09:40Z
Modified
2026-10-20T21:15:04Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Cachet has Stored XSS in Incident Component
Details

Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.

Details

The incident Name and Message fields do not properly sanitize HTML event handler attributes. While

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-20T21:09:40Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / cachethq/cachet

Package

Name
cachethq/cachet
Purl
pkg:composer/cachethq/cachet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.4.1

Affected versions

v0.*
v0.1.0-alpha
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v2.*
v2.0.0-beta1
v2.0.0-beta2
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.0-RC5
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0-RC1
v2.1.0-RC2
v2.1.0
v2.1.1
v2.1.2
v2.2.0-RC1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.3.0-RC1
v2.3.0-RC2
v2.3.0-RC3
v2.3.0-RC4
v2.3.0-RC5
v2.3.0-RC6
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.4.0
v2.4.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x397-5hrv-j9m9/GHSA-x397-5hrv-j9m9.json"