CVE-2026-45627

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> element of the embedded logo.svg, allowing an attacker to close the style block and inject executable <script> content. Because the response is served as image/svg+xml and Arcane sets no Content-Security-Policy or X-Content-Type-Options headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account. This vulnerability is fixed in 1.19.0.

• CWE-79

• https://github.com/getarcaneapp/arcane/security/advisories/GHSA-q2pj-8v84-9mh5

Published

May 29, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45620WWBN AVideo is an open source video platform. In 29.0 and ea…5.3
• CVE-2026-45622Vvveb is a powerful and easy to use CMS with page builder to…5.3
• CVE-2026-45623PostCSS takes a CSS file and provides an API to analyze and …9.1
• CVE-2026-45624ImageMagick is free and open-source software used for editin…5.1
• CVE-2026-45625Arcane is an interface for managing Docker containers, image…9.9
• CVE-2026-45626Arcane is an interface for managing Docker containers, image…6.3
• CVE-2026-45628Dokploy is a free, self-hostable Platform as a Service (PaaS…9.6
• CVE-2026-45629Dokploy is a free, self-hostable Platform as a Service (PaaS…9.9
• CVE-2026-4563A weakness has been identified in MacCMS up to 2025.1000.405…4.3
• CVE-2026-45630Dokploy is a free, self-hostable Platform as a Service (PaaS…9
• CVE-2026-45631Dokploy is a free, self-hostable Platform as a Service (PaaS…10
• CVE-2026-45632Dokploy is a free, self-hostable Platform as a Service (PaaS…9.9