{"id":"CVE-2026-75599","kind":"vulnerability","aliases":["CVE-2026-75599"],"related":[],"title":"HomeBox: custom-field links allow javascript URIs, enabling stored XSS","description":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.","summary":"HomeBox is a self-hosted home inventory app. Before 0.27.0, an authenticated user can store a javascript: link in a custom field, and when another authenticated user clicks it, script runs in the victim's HomeBox session, enabling session theft and account takeover.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["homebox","other","self-hosted"],"not_affected_if":["single-trusted-user","version-0.27.0-or-later"],"how_to_check":"- Check the HomeBox version in use; versions before `0.27.0` are affected.\n- Look for custom-field values on item pages that contain markdown-style links with a `javascript:` target.","fix":"- Upgrade HomeBox to `0.27.0` or later.","status":"open","published_at":"2026-11-05T17:18:20+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","triaged_at":"2026-11-05T17:42:35+00:00","updated_at":"2026-11-05T17:42:35+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-05T17:42:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HomeBox to `0.27.0` or later.","reach":"network","title":"HomeBox: custom-field links allow javascript URIs, enabling stored XSS","impact":"high","summary":"HomeBox is a self-hosted home inventory app. Before 0.27.0, an authenticated user can store a javascript: link in a custom field, and when another authenticated user clicks it, script runs in the victim's HomeBox session, enabling session theft and account takeover.","audience":"businesses","category":"other","nicknames":[],"who_cares":["homebox","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script runs in victim's session, stealing sessions or data","analyst_note":"","how_to_check":"- Check the HomeBox version in use; versions before `0.27.0` are affected.\n- Look for custom-field values on item pages that contain markdown-style links with a `javascript:` target.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.27.0-or-later","single-trusted-user"],"who_is_affected":"Teams that self-host HomeBox before 0.27.0 and let multiple authenticated users edit item custom fields. Exposure requires a user to click a malicious link on an item page; instances with only one trusted user, or running 0.27.0 or later, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":4320,"output_tokens":514,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-75599':14A,17A '0.27.0':33B,77C,149C 'accept':81C 'account':65B,138C 'allow':6A 'anchor':112C 'anoth':48B,118C 'app':31B 'attack':125C 'attacker-control':124C 'authent':35B,49B,99C,119C 'click':51B,121C 'clickabl':111C 'control':126C 'custom':3A,44B,89C 'custom-field':2A,88C 'cve':12A,15A 'data':141C 'enabl':9A,61B,135C 'entiti':87C 'execut':128C 'exfiltr':142C 'field':4A,45B,90C 'fix':146C 'home':29B,70C 'homebox':1A,18B,23B,59B,67C,133C 'host':22B,28B 'inventori':30B,71C 'issu':144C 'item':115C 'javascript':7A,40B,104C,127C 'link':5A,41B,85C,123C 'markdown':83C 'markdown-styl':82C 'maybeurl':79C 'organ':73C 'origin':134C 'page':116C 'prior':75C 'render':108C 'restrict':93C 'run':54B 'scheme':96C 'script':53B 'self':21B,27B 'self-host':20B,26B 'session':60B,62B,136C 'store':10A,38B,102C 'style':84C 'system':74C 'takeov':66B,139C 'theft':63B,137C 'uri':8A,105C 'url':95C 'user':36B,50B,100C,120C 'util':80C 'valu':91C 'version':148C 'victim':57B,131C 'without':92C 'xss':11A","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host HomeBox before 0.27.0 and let multiple authenticated users edit item custom fields. Exposure requires a user to click a malicious link on an item page; instances with only one trusted user, or running 0.27.0 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["homebox","medium","other","selfhosted"],"campaign_type":null,"first_public_at":"2026-10-17T16:16:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75599","severity":null,"published_at":"2026-11-05T17:18:20+00:00","modified_at":"2026-11-05T17:18:20+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","fetched_at":"2026-11-05T17:40:05+00:00","note":null}],"documents":[{"id":78125,"url":"https://github.com/sysadminsmedia/homebox/commit/d76b1c9b94e91cd74e56ef8a129325d70835471f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":48316,"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78127,"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h4x5-6587-jpwp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-17T16:16:49+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}