CVE-2026-75599
HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.
| CWE | CWE-79 |
| Vendor | sysadminsmedia |
| Product | homebox |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for sysadminsmedia homebox
Be the first to know when new medium vulnerabilities affecting sysadminsmedia homebox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
sysadminsmedia / homebox
< 0.27.0