Cockpit CMS Stored Cross-Site Scripting Vulnerability in Set Field Display Template

A stored cross-site scripting vulnerability has been identified in Cockpit CMS versions through 2.14.0. This issue, patched in commit 72a83fc, arises in the Set field type's Display template option. The vulnerability occurs because the template string is processed by the $interpolate function using new Function(), and then rendered via Vue's v-html directive without proper sanitization. An attacker with content/:models/manage permission can inject arbitrary JavaScript into the Display template, which is executed in the browser of any user viewing the collection items list.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the affected collection items.

Remediation

Users can update to Cockpit CMS version 2.14.0 or later to address this vulnerability.