Medium
cockpit — security advisory
Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components
- Products
- cockpit
- Affected versions
- 151-1, 156-1, 157-1, 158-1, 160-1, 161-1, 162-1, 163-1, 164-1, 202.1-1, 204-1, 206-1, 207-1, 208-1, 210-1, 211-1, 212-1, 213-1, 214.1-1, 215-1, 252-1, 256-1, 257-1, 258-1, 259-1, 260-1, 261-1, 262-1, 263-1, 264-1, 264-1ubuntu0.22.04.1, 300.1-1, 303-1, 304-1, 305-1, 306-1, 307-1, 308-1, 309-1, 310.1-1, 311-1, 312-1build2, 314-1, 346-1, 348-1, 350-1, 352-1, 353.1-1, 354-1, 355-1, 356-1, 360-1, 362-1, 365-1, 367-1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-39275
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:02 UTC · Revision 1
Source evidence
Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components
osv:UBUNTU-CVE-2026-39275
cockpit
Fixed versions: Not specified
cockpit
Fixed versions: Not specified
cockpit
Fixed versions: Not specified
cockpit
Fixed versions: Not specified
cockpit
Fixed versions: Not specified
cockpit
Fixed versions: Not specified
Complete source record
{
"id": "6dc0bc5f524068c21448ca46c92aaca815916e292ad39215f5d35b726dd8656c",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-39275",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-39275",
"summary": "Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components",
"evidence": "osv:UBUNTU-CVE-2026-39275",
"products": [
{
"name": {
"value": "cockpit",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "151-1",
"evidence": "/affected/0/versions"
},
{
"value": "156-1",
"evidence": "/affected/0/versions"
},
{
"value": "157-1",
"evidence": "/affected/0/versions"
},
{
"value": "158-1",
"evidence": "/affected/0/versions"
},
{
"value": "160-1",
"evidence": "/affected/0/versions"
},
{
"value": "161-1",
"evidence": "/affected/0/versions"
},
{
"value": "162-1",
"evidence": "/affected/0/versions"
},
{
"value": "163-1",
"evidence": "/affected/0/versions"
},
{
"value": "164-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "cockpit",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "202.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "204-1",
"evidence": "/affected/1/versions"
},
{
"value": "206-1",
"evidence": "/affected/1/versions"
},
{
"value": "207-1",
"evidence": "/affected/1/versions"
},
{
"value": "208-1",
"evidence": "/affected/1/versions"
},
{
"value": "210-1",
"evidence": "/affected/1/versions"
},
{
"value": "211-1",
"evidence": "/affected/1/versions"
},
{
"value": "212-1",
"evidence": "/affected/1/versions"
},
{
"value": "213-1",
"evidence": "/affected/1/versions"
},
{
"value": "214.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "215-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "cockpit",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "252-1",
"evidence": "/affected/2/versions"
},
{
"value": "256-1",
"evidence": "/affected/2/versions"
},
{
"value": "257-1",
"evidence": "/affected/2/versions"
},
{
"value": "258-1",
"evidence": "/affected/2/versions"
},
{
"value": "259-1",
"evidence": "/affected/2/versions"
},
{
"value": "260-1",
"evidence": "/affected/2/versions"
},
{
"value": "261-1",
"evidence": "/affected/2/versions"
},
{
"value": "262-1",
"evidence": "/affected/2/versions"
},
{
"value": "263-1",
"evidence": "/affected/2/versions"
},
{
"value": "264-1",
"evidence": "/affected/2/versions"
},
{
"value": "264-1ubuntu0.22.04.1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "cockpit",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "300.1-1",
"evidence": "/affected/3/versions"
},
{
"value": "303-1",
"evidence": "/affected/3/versions"
},
{
"value": "304-1",
"evidence": "/affected/3/versions"
},
{
"value": "305-1",
"evidence": "/affected/3/versions"
},
{
"value": "306-1",
"evidence": "/affected/3/versions"
},
{
"value": "307-1",
"evidence": "/affected/3/versions"
},
{
"value": "308-1",
"evidence": "/affected/3/versions"
},
{
"value": "309-1",
"evidence": "/affected/3/versions"
},
{
"value": "310.1-1",
"evidence": "/affected/3/versions"
},
{
"value": "311-1",
"evidence": "/affected/3/versions"
},
{
"value": "312-1build2",
"evidence": "/affected/3/versions"
},
{
"value": "314-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "cockpit",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "360-1",
"evidence": "/affected/4/versions"
},
{
"value": "362-1",
"evidence": "/affected/4/versions"
},
{
"value": "365-1",
"evidence": "/affected/4/versions"
},
{
"value": "367-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "cockpit",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "346-1",
"evidence": "/affected/5/versions"
},
{
"value": "348-1",
"evidence": "/affected/5/versions"
},
{
"value": "350-1",
"evidence": "/affected/5/versions"
},
{
"value": "352-1",
"evidence": "/affected/5/versions"
},
{
"value": "353.1-1",
"evidence": "/affected/5/versions"
},
{
"value": "354-1",
"evidence": "/affected/5/versions"
},
{
"value": "355-1",
"evidence": "/affected/5/versions"
},
{
"value": "356-1",
"evidence": "/affected/5/versions"
},
{
"value": "360-1",
"evidence": "/affected/5/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-39275",
"aliases": [
"UBUNTU-CVE-2026-39275"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "cockpit",
"purl": "pkg:deb/ubuntu/cockpit?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"151-1",
"156-1",
"157-1",
"158-1",
"160-1",
"161-1",
"162-1",
"163-1",
"164-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39275.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cockpit",
"binary_version": "164-1"
},
{
"binary_name": "cockpit-bridge",
"binary_version": "164-1"
},
{
"binary_name": "cockpit-dashboard",
"binary_version": "164-1"
},
{
"binary_name": "cockpit-docker",
"binary_version": "164-1"
},
{
"binary_name": "cockpit-machines",
"binary_version": "164-1"
},
{
"binary_name": "cockpit-networkmanager",
"binary_version": "164-1"
},
{
"binary_name": "cockpit-packagekit",
"binary_version": "164-1"
},
{
"binary_name": "cockpit-storaged",
"binary_version": "164-1"
},
{
"binary_name": "cockpit-system",
"binary_version": "164-1"
},
{
"binary_name": "cockpit-tests",
"binary_version": "164-1"
},
{
"binary_name": "cockpit-ws",
"binary_version": "164-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "cockpit",
"purl": "pkg:deb/ubuntu/cockpit?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"202.1-1",
"204-1",
"206-1",
"207-1",
"208-1",
"210-1",
"211-1",
"212-1",
"213-1",
"214.1-1",
"215-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39275.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cockpit",
"binary_version": "215-1"
},
{
"binary_name": "cockpit-bridge",
"binary_version": "215-1"
},
{
"binary_name": "cockpit-dashboard",
"binary_version": "215-1"
},
{
"binary_name": "cockpit-machines",
"binary_version": "215-1"
},
{
"binary_name": "cockpit-networkmanager",
"binary_version": "215-1"
},
{
"binary_name": "cockpit-packagekit",
"binary_version": "215-1"
},
{
"binary_name": "cockpit-pcp",
"binary_version": "215-1"
},
{
"binary_name": "cockpit-storaged",
"binary_version": "215-1"
},
{
"binary_name": "cockpit-system",
"binary_version": "215-1"
},
{
"binary_name": "cockpit-tests",
"binary_version": "215-1"
},
{
"binary_name": "cockpit-ws",
"binary_version": "215-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "cockpit",
"purl": "pkg:deb/ubuntu/cockpit?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"252-1",
"256-1",
"257-1",
"258-1",
"259-1",
"260-1",
"261-1",
"262-1",
"263-1",
"264-1",
"264-1ubuntu0.22.04.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39275.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cockpit",
"binary_version": "264-1ubuntu0.22.04.1"
},
{
"binary_name": "cockpit-bridge",
"binary_version": "264-1ubuntu0.22.04.1"
},
{
"binary_name": "cockpit-networkmanager",
"binary_version": "264-1ubuntu0.22.04.1"
},
{
"binary_name": "cockpit-packagekit",
"binary_version": "264-1ubuntu0.22.04.1"
},
{
"binary_name": "cockpit-pcp",
"binary_version": "264-1ubuntu0.22.04.1"
},
{
"binary_name": "cockpit-sosreport",
"binary_version": "264-1ubuntu0.22.04.1"
},
{
"binary_name": "cockpit-storaged",
"binary_version": "264-1ubuntu0.22.04.1"
},
{
"binary_name": "cockpit-system",
"binary_version": "264-1ubuntu0.22.04.1"
},
{
"binary_name": "cockpit-tests",
"binary_version": "264-1ubuntu0.22.04.1"
},
{
"binary_name": "cockpit-ws",
"binary_version": "264-1ubuntu0.22.04.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "cockpit",
"purl": "pkg:deb/ubuntu/cockpit?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"300.1-1",
"303-1",
"304-1",
"305-1",
"306-1",
"307-1",
"308-1",
"309-1",
"310.1-1",
"311-1",
"312-1build2",
"314-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39275.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cockpit",
"binary_version": "314-1"
},
{
"binary_name": "cockpit-bridge",
"binary_version": "314-1"
},
{
"binary_name": "cockpit-networkmanager",
"binary_version": "314-1"
},
{
"binary_name": "cockpit-packagekit",
"binary_version": "314-1"
},
{
"binary_name": "cockpit-pcp",
"binary_version": "314-1"
},
{
"binary_name": "cockpit-sosreport",
"binary_version": "314-1"
},
{
"binary_name": "cockpit-storaged",
"binary_version": "314-1"
},
{
"binary_name": "cockpit-system",
"binary_version": "314-1"
},
{
"binary_name": "cockpit-tests",
"binary_version": "314-1"
},
{
"binary_name": "cockpit-ws",
"binary_version": "314-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "cockpit",
"purl": "pkg:deb/ubuntu/cockpit?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"360-1",
"362-1",
"365-1",
"367-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39275.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cockpit",
"binary_version": "367-1"
},
{
"binary_name": "cockpit-bridge",
"binary_version": "367-1"
},
{
"binary_name": "cockpit-networkmanager",
"binary_version": "367-1"
},
{
"binary_name": "cockpit-packagekit",
"binary_version": "367-1"
},
{
"binary_name": "cockpit-sosreport",
"binary_version": "367-1"
},
{
"binary_name": "cockpit-storaged",
"binary_version": "367-1"
},
{
"binary_name": "cockpit-system",
"binary_version": "367-1"
},
{
"binary_name": "cockpit-ws",
"binary_version": "367-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "cockpit",
"purl": "pkg:deb/ubuntu/cockpit?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"346-1",
"348-1",
"350-1",
"352-1",
"353.1-1",
"354-1",
"355-1",
"356-1",
"360-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39275.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cockpit",
"binary_version": "360-1"
},
{
"binary_name": "cockpit-bridge",
"binary_version": "360-1"
},
{
"binary_name": "cockpit-networkmanager",
"binary_version": "360-1"
},
{
"binary_name": "cockpit-packagekit",
"binary_version": "360-1"
},
{
"binary_name": "cockpit-sosreport",
"binary_version": "360-1"
},
{
"binary_name": "cockpit-storaged",
"binary_version": "360-1"
},
{
"binary_name": "cockpit-system",
"binary_version": "360-1"
},
{
"binary_name": "cockpit-ws",
"binary_version": "360-1"
}
]
}
}
],
"modified": "2026-10-17T13:00:03.199613186Z",
"provider": "osv",
"upstream": [
"CVE-2026-39275"
],
"references": [
"https://ubuntu.com/security/CVE-2026-39275",
"https://www.cve.org/CVERecord?id=CVE-2026-39275"
]
},
"related_cves": [
{
"value": "CVE-2026-39275",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 360204,
"published_at": "2026-08-26T21:16:00+00:00"
}