CVE-2026-5253
Cross-Site Scripting in bufanyun HotGo editNotice Endpoint
Publication date: 2026-04-01
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bufanyun | hotgo | 1.0 |
| bufanyun | hotgo | to 2.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5253 is a stored Cross-Site Scripting (XSS) vulnerability found in the HotGo software versions up to and including 2.0. It exists in the system notice functionality, specifically in the /admin/notice/editNotice endpoint, which accepts user-supplied content without sanitization or validation.
This content is stored directly in the database and later rendered on the frontend using Vue.js's v-html directive in the file /web/src/layout/components/Header/MessageList.vue. The v-html directive renders HTML content as-is without sanitization, allowing malicious JavaScript code injected by an authenticated attacker to execute in the browsers of users viewing the system notice.
A proof of concept involves injecting a payload such as <img src=x onerror='alert(1)' />, which triggers JavaScript execution when the notice is viewed.
How can this vulnerability impact me? :
This vulnerability can lead to several security impacts including session hijacking, credential theft, and unauthorized actions performed on behalf of the victim.
Since the malicious script executes in the context of the victim's browser, attackers can steal sensitive information or perform actions as the victim without their consent.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /admin/notice/editNotice endpoint for stored Cross-Site Scripting (XSS) issues. An authenticated user can attempt to create a system notice containing a typical XSS payload such as <img src=x onerror='alert(1)' />. If the payload executes when the notice is viewed, the system is vulnerable.
Detection involves verifying if user-supplied content is rendered without sanitization in the frontend component /web/src/layout/components/Header/MessageList.vue, specifically where Vue.js's v-html directive is used.
Suggested commands or steps include:
- Use a web browser or automated tool to authenticate and submit a crafted notice payload to the /admin/notice/editNotice endpoint.
- Observe the frontend display of the notice for execution of injected JavaScript (e.g., alert popup).
- Use web application security scanners that support XSS detection on authenticated endpoints.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Implement HTML sanitization on user-supplied content before storing it in the database, using libraries such as DOMPurify.
- Avoid using Vue.js's v-html directive to render untrusted content directly.
- Apply Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts.
- Validate input against a whitelist of allowed HTML tags and attributes before accepting and storing notices.
- Encode output appropriately based on the context to prevent script execution.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The stored Cross-Site Scripting (XSS) vulnerability in HotGo allows attackers to execute malicious scripts in users' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of victims.
Such security weaknesses can compromise the confidentiality and integrity of user data, which may lead to non-compliance with data protection regulations like GDPR and HIPAA that require adequate safeguards against unauthorized access and data breaches.
Failure to address this vulnerability could result in exposure of personal or sensitive information, thereby violating regulatory requirements for protecting user data privacy and security.