CVE-2026-60119 Details
Description
Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, which is not escaped by JSON.stringify() when embedded in inline script tags. Attackers can craft an event title that breaks out of the script context in the application/ld+json structured data block or server-side rehydrated state, causing the payload to execute in the browser of any user who views the public event page, including unauthenticated visitors and authenticated administrators.
A cross-site scripting (XSS) vulnerability has been identified in Hi.Events versions through v1.10.0-beta. This issue allows authenticated attackers with permissions to create or edit events to inject arbitrary HTML and JavaScript. The vulnerability arises because the event title is not properly escaped by JSON.stringify() when it includes the </script> sequence. Exploitation involves crafting a title that escapes the script context in the application/ld+json structured data or server-side rehydrated state, leading to execution in the browser of anyone viewing the public event page, including unauthenticated users and authenticated administrators.
Users are advised to update to Hi.Events version v1.11.0-beta or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2ggx-79g6-2jmj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/HiEventsDev/Hi.Events/commit/1e36b070771801ed7113255ef7b3a7f271a2a794 | [email protected] | Source CodeVendor |
| https://github.com/HiEventsDev/Hi.Events/pull/1260 | [email protected] | Issue TrackingVendor |
| https://github.com/HiEventsDev/Hi.Events/releases/tag/v.1.11.0-beta | [email protected] | Release NotesVendor |
| https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2ggx-79g6-2jmj | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/hi-events-beta-xss-via-event-title-json-stringify-injection | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hi.Events | <= v1.10.0-beta (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |