CVE-2026-60119

Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection

View on CVE.org
Published Jul 14, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, which is not escaped by JSON.stringify() when embedded in inline script tags. Attackers can craft an event title that breaks out of the script context in the application/ld+json structured data block or server-side rehydrated state, causing the payload to execute in the browser of any user who views the public event page, including unauthenticated visitors and authenticated administrators.

Analysis

AI-generated

Technical impact

Hi.Events versions prior to 1.11.0 contain a cross‑site scripting flaw that allows an authenticated user with permission to create or edit events to embed arbitrary HTML and JavaScript through an event title. When the title includes the sequence </script>, the content is not properly escaped by JSON.stringify() before being placed inside inline the injected code is executed in the browser of anyone who views the public event page, including unauthenticated visitors and administrators.

Affected Systems

All releases of Hi.Events from HiEventsDev prior to version 1.11.0, including the 1.10.x series

Risk and Exploitability

The vulnerability has a CVSS score of 5.1 and an EPSS score of less than 1%, indicating a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. Attackers must be authenticated with event creation or edit rights to inject malicious titles, after which any user who views the event page will be exposed to the malicious script. The weakness, classified as CWE‑862, arises from insufficient input validation of stored fields that are later rendered in a script context.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Hi.Events to version 1.11.0-beta or newer.
  • If upgrade is delayed, enforce input validation to block or escape the string "</script>" in event titles before rendering.
  • Apply a Content Security Policy that restricts inline script execution and use a web application firewall to detect and block XSS payloads.

Generated by OpenCVE AI on July 31, 2026 at 10:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Hi.events
Hi.events hi.events
CPEs cpe:2.3:a:hi.events:hi.events:*:*:*:*:*:*:*:*
Vendors & Products Hi.events
Hi.events hi.events
Type Values Removed Values Added
Description Hi.Events through v1.10.0-beta contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, which is not escaped by JSON.stringify() when embedded in inline script tags. Attackers can craft an event title that breaks out of the script context in the application/ld+json structured data block or server-side rehydrated state, causing the payload to execute in the browser of any user who views the public event page, including unauthenticated visitors and authenticated administrators. Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, which is not escaped by JSON.stringify() when embedded in inline script tags. Attackers can craft an event title that breaks out of the script context in the application/ld+json structured data block or server-side rehydrated state, causing the payload to execute in the browser of any user who views the public event page, including unauthenticated visitors and authenticated administrators.
Title Hi.Events v1.10.0-beta XSS via Event Title JSON.stringify Injection Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection
Type Values Removed Values Added
First Time appeared Hieventsdev
Hieventsdev hi.events
Vendors & Products Hieventsdev
Hieventsdev hi.events
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Hi.Events through v1.10.0-beta contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, which is not escaped by JSON.stringify() when embedded in inline script tags. Attackers can craft an event title that breaks out of the script context in the application/ld+json structured data block or server-side rehydrated state, causing the payload to execute in the browser of any user who views the public event page, including unauthenticated visitors and authenticated administrators.
Title Hi.Events v1.10.0-beta XSS via Event Title JSON.stringify Injection
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 8, 2026, 2:07 PM
Reserved
Jul 8, 2026, 1:27 PM

View source JSON

Updated
Jul 14, 2026, 5:28 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 4:17 PM
Modified
Oct 24, 2026, 9:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 10:15 AM

JSON