CVE-2026-39275: n/a

This vulnerability in Cockpit CMS (<=2.13.5) involves Cross Site Scripting (CWE-79) through the item.php, field-select.js, and tags.js components. An unauthenticated remote attacker can exploit this flaw to execute arbitrary code in the context of the affected application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impact and no availability impact.

Successful exploitation could allow an attacker to execute arbitrary code in the victim's browser session, potentially leading to partial confidentiality and integrity compromise within the affected application context. There is no reported impact on availability. No active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor channels for updates. Until a fix is available, consider limiting exposure to the vulnerable components and applying any recommended workarounds from the vendor if published.