High · 7.6 CVE-2026-5301 EUVD-2026-20459GHSA-6vr8-827j-mg8v

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in coolercontrol-ui

Published Apr 8, 2026 · Updated Apr 8, 2026 · Assigned by GitLab

Vendor: CoolerControl Product: coolercontrol-ui

Description

Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisoned log entries

Affected products

Vendor	Product	Affected	Fixed
CoolerControl	coolercontrol-ui	2.0.0 – < 4.0.0	4.0.0

References

https://gitlab.com/coolercontrol/coolercontrol/-/blob/2.0.0/coolercontrol-ui/src/views/AppInfoView.vue?ref_type=tags#L224
https://gitlab.com/coolercontrol/coolercontrol/-/blob/3.1.1/coolercontrol-ui/src/views/AppInfoView.vue?ref_type=tags#L350
https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0