CVE-2026-45627 Details
Description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> element of the embedded logo.svg, allowing an attacker to close the style block and inject executable <script> content. Because the response is served as image/svg+xml and Arcane sets no Content-Security-Policy or X-Content-Type-Options headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account. This vulnerability is fixed in 1.19.0.
A reflected cross-site scripting vulnerability has been identified in Arcane, a Docker management interface, in versions through 1.18.1. The issue arises in the unauthenticated GET /api/app-images/logo endpoint, which improperly reflects user-supplied color query parameters into an SVG document. This is achieved using strings.ReplaceAll without proper escaping, allowing an attacker to inject executable <script> tags by closing the <style> element of the logo.svg. The injected script is executed in the context of the Arcane origin, exploiting the victim's HttpOnly JWT cookie to compromise their admin account. This vulnerability is fixed in Arcane version 1.19.0.
Users are advised to update to Arcane version 1.19.0 or later. Additionally, implement a Content-Security-Policy that restricts script execution and an X-Content-Type-Options header to prevent MIME type sniffing. Consider serving SVG images from a separate cookie-less origin to eliminate session riding vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 29, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getarcaneapp/arcane/security/advisories/GHSA-q2pj-8v84-9mh5 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Arcane | <= 1.18.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |