CVE-2026-126954
Received Received - Intake

Stored XSS in Glance Dashboard Widget Titles

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title, reading dashboard pages through same-origin requests and exfiltrating content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126954
EUVD
EUVD-2026-125111

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
glanceapp glance From 0.7.9 (inc) to 0.8.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Glance versions 0.7.9 through 0.8.7. Attackers controlling an extension endpoint can inject a javascript: URL via the Widget-Title-URL response header. When users click the widget title, the malicious script executes in the Glance origin, allowing attackers to read dashboard pages and exfiltrate content.

Detection Guidance

Check Glance version with: curl -s http://localhost:8080/version | grep version. If version is <=0.8.7, the system is vulnerable. Inspect extension endpoints for Widget-Title-URL headers containing javascript: URLs using browser dev tools or curl -I http://extension-endpoint.

Impact Analysis

If you use Glance versions 0.7.9 to 0.8.7, an attacker could steal sensitive data from your dashboard by tricking you into clicking a malicious widget title. This includes private pages or any content accessible to your authenticated session. The attack is persistent and affects all users viewing the compromised dashboard.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected Glance versions may face compliance violations if user data is exfiltrated.

Mitigation Strategies

Upgrade Glance to version 0.8.8 or later immediately. If upgrading is not possible, disable all untrusted extension endpoints or remove the safeURL function from widget title rendering in widget-base.html.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126954. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...