Coolify Stored Cross-Site Scripting Vulnerability in Project Creation Workflow

A stored cross-site scripting vulnerability has been identified in Coolify versions prior to v4.0.0-beta.420.6. This issue allows an authenticated user with low privileges to create a project with a name that includes embedded JavaScript. When an administrator tries to delete the project or its related resources, the malicious payload executes in the admin's browser, potentially compromising the entire Coolify instance. This could lead to the theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected project, particularly administrators.

Remediation

Users are advised to update to Coolify version v4.0.0-beta.420.7 or later, where this vulnerability has been fixed.