CVE-2026-65697 Details

A stored cross-site scripting vulnerability has been identified in Fathom Lite versions through 1.3.1. This vulnerability resides in the analytics collection endpoint, where unauthenticated attackers can inject a javascript: URI into the Top Pages dashboard. The injection is achieved by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint. The vulnerability arises because the parseHostname and parsePathname functions do not validate URI schemes, allowing a javascript: hostname combined with a newline-prefixed pathname to be stored and later rendered as an anchor href in the authenticated dashboard without proper sanitization. This exploitation enables session hijacking and full account takeover when an operator clicks the compromised entry.