Stored XSS in Fathom Lite Analytics Dashboard

Executive Summary

CVE-2026-65697 is a stored cross-site scripting (XSS) vulnerability in Fathom Lite through version 1.3.1. It allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by sending a crafted hostname and pathname to the unauthenticated /collect endpoint. The functions parseHostname and parsePathname do not validate URI schemes, enabling the injection. The malicious input is stored and later rendered as an anchor href in the authenticated dashboard without sanitization, allowing session hijacking and full account takeover when clicked.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to the /collect endpoint with unusual hostname or pathname values. Check server logs for entries containing 'javascript:' URIs or newline characters in the hostname/pathname fields. Use tools like curl to test the endpoint: curl -X POST http://<target>/collect -d 'hostname=javascript:alert(1)&pathname=%0Atest' and observe if the response or dashboard reflects the injected payload.

Useful 0 Not Useful 0

Impact Analysis

An attacker could hijack your session, steal session cookies, manipulate user accounts, or exfiltrate data. The attack requires only the public site tracking ID, which is embedded in the tracking snippet of any page using Fathom. Clicking a poisoned entry in the Top Pages dashboard would execute arbitrary JavaScript in the dashboard's origin, giving the attacker full control over your session.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. A successful attack may result in data breaches, unauthorized data access, or data exfiltration, which are non-compliant with these regulations. Organizations using affected Fathom Lite versions may face compliance violations and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Fathom Lite to the latest version beyond 1.3.1. If upgrading is not possible, disable the /collect endpoint or restrict access to it via firewall rules. Implement strict input validation for hostname and pathname parameters in the tracking endpoint. Sanitize all user-controlled data before rendering in the dashboard to prevent XSS execution.

Useful 0 Not Useful 0