{"affected":[{"product":"homebox","source":"CNA: GitHub_M","vendor":"sysadminsmedia","versions":[{"status":"affected","version":"< 0.27.0"}]},{"ecosystem":"docker","packageName":"ghcr.io/sysadminsmedia/homebox","product":"ghcr.io/sysadminsmedia/homebox","source":"GitHub GHSA-h4x5-6587-jpwp","vendor":"","versions":[{"status":"affected","version":"< 0.26.2","versionType":"GitHub advisory range"}]},{"ecosystem":"docker","packageName":"sysadminsmedia/homebox","product":"sysadminsmedia/homebox","source":"GitHub GHSA-h4x5-6587-jpwp","vendor":"","versions":[{"status":"affected","version":"< 0.26.2","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-75599","cwes":["CWE-79"],"description":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.","epss":{"date":"2026-11-09","percentile":0.05809,"score":0.00165},"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},{"score":5.4,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794266245987,"publishedAt":1793894557520,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h4x5-6587-jpwp"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sysadminsmedia/homebox/commit/d76b1c9b94e91cd74e56ef8a129325d70835471f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/sysadminsmedia/homebox/commit/d76b1c9b94e91cd74e56ef8a129325d70835471f"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h4x5-6587-jpwp"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h4x5-6587-jpwp"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-h4x5-6587-jpwp","text":"ghcr.io/sysadminsmedia/homebox (docker): GitHub reports patched versions 0.27.0. Check the advisory for the affected release branch.","url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h4x5-6587-jpwp"},{"kind":"fix","source":"GitHub GHSA-h4x5-6587-jpwp","text":"sysadminsmedia/homebox (docker): GitHub reports patched versions 0.27.0. Check the advisory for the affected release branch.","url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h4x5-6587-jpwp"}],"revision":"13d77f0051dbdaaefdfaf6b35a93b849e435e79d13c3f591f96d4ee30b2ba684","sources":[{"modifiedAt":1794262520752,"name":"CNA: GitHub_M","retrievedAt":1794265839276,"url":"https://www.cve.org/CVERecord?id=CVE-2026-75599"},{"modifiedAt":1794266245987,"name":"NVD","retrievedAt":1794269885960,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75599"},{"modifiedAt":1792253809000,"name":"GitHub Security Advisories","retrievedAt":1794056711235,"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h4x5-6587-jpwp"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794265853278,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75599"}],"ssvc":{"assessedAt":1794262505426,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields","updatedAt":1794269885960}