CVE-2026-75599

Full vulnerability record from the local CVENow database.

Description

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.

Severity

MEDIUM

CVSS score

5.4 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-05 17:18:20.340000

Last modified

2026-11-05 17:18:20.340000

View original CVE JSON

{
  "id": "CVE-2026-75599",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T17:18:20.340",
  "lastModified": "2026-11-05T17:18:20.340",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "sysadminsmedia",
          "product": "homebox",
          "versions": [
            {
              "version": "< 0.27.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sysadminsmedia/homebox/commit/d76b1c9b94e91cd74e56ef8a129325d70835471f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h4x5-6587-jpwp",
      "source": "[email protected]"
    }
  ]
}