Cachet has Stored XSS in Incident Component
Medium
### Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. ### Details The incident Name and Message fields do not properly sanitize HTML event handler attributes. Log in as an authenticated user 2. Navigate to /dashboard/incidents/ 3. Create a new incident 4. Save the incident 6. Navigate to the public status page 7.
Remediation
No patched version is listed in the advisory yet — follow the source advisory for mitigations and updates.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-x397-5hrv-j9m9