CVE-2026-65697
Last modified
CVE-2026-65697 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint. The parseHostname and parsePathname functions perform no URI scheme validation, allowing a javascript: hostname combined with a newline-prefixed pathname to be stored and later rendered as an anchor href in the authenticated dashboard without sanitization, enabling session hijacking and full account takeover when an operator clicks the poisoned entry..
Description
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint. The parseHostname and parsePathname functions perform no URI scheme validation, allowing a javascript: hostname combined with a newline-prefixed pathname to be stored and later rendered as an anchor href in the authenticated dashboard without sanitization, enabling session hijacking and full account takeover when an operator clicks the poisoned entry.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| usefathom | fathom | <= 1.3.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-65697?
How severe is CVE-2026-65697?
How do I fix CVE-2026-65697?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-6569A vulnerability was identified in kodcloud KodExplorer up to…7.3
- CVE-2026-65690Bold Reports Standalone Report Designer before 14.1.12 conta…8.8
- CVE-2026-65693Microweber CMS through 2.0.20 contains a server-side templat…8.6
- CVE-2026-65694Microweber CMS through 2.0.20 contains a path traversal vuln…8.7
- CVE-2026-65695Office-Word-MCP-Server through 1.1.11 contains a path traver…7.6
- CVE-2026-65696Overseerr through 1.35.0 contains an authorization bypass th…5.4
- CVE-2026-65698Void through 1.3.4 contains a path traversal vulnerability i…6
- CVE-2026-65699AgentGPT through 1.0.0 contains an authorization bypass thro…4.2
- CVE-2026-6570A security flaw has been discovered in kodcloud KodExplorer …2.7
- CVE-2026-65700h2oGPT through 0.2.1 contains a path traversal vulnerability…9.8
- CVE-2026-65701SoftVC VITS Singing Voice Conversion through commit 730930d …9.3
- CVE-2026-65702Vanna through 2.0.2 contains a path traversal vulnerability …8.6
Are you affected by CVE-2026-65697?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST