CVE-2026-5301
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In CoolerControl/coolercontrol-ui versions before 4.0.0, there is a Stored XSS vulnerability in the log viewer. Unauthenticated attackers can take over the service via malicious JavaScript in poisoned log entries.
Risk Assessment
The risk involves the possibility of service takeover by an unauthenticated attacker, which could lead to data theft, configuration modification, or further system compromise.
Recommendation
Immediately update CoolerControl/coolercontrol-ui to version 4.0.0 or later, which contains the fix for this vulnerability.
Other vulnerabilities in CoolerControl
See all- CVE-2026-5302Medium
CoolerControl/coolercontrold before version 4.0.0 has a CORS misconfiguration, allowing unauthenticated remote attackers to read data and send commands to the service via malicious websites.
- CVE-2026-5300Medium
In CoolerControl/coolercontrold before version 4.0.0, unauthenticated functionality allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests.
- CVE-2026-5208High
In CoolerControl/coolercontrold before version 4.0.0, a command injection vulnerability in alerts allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names.
Original NVD description (English source)
Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisoned log entries