Cockpit CMS through version 2.14.0 is affected by a stored cross-site scripting vulnerability in the Set field type's Display template option. The vulnerability occurs because the template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization, allowing injection of arbitrary JavaScript. An attacker with content/:models/manage permission can exploit this to execute malicious scripts in the browsers of users viewing the collection items list. The issue was patched in commit 72a83fc, which is included in version 2.14.0.

An attacker with content/:models/manage permission can inject arbitrary JavaScript code into the Display template option of the Set field type. This code executes in the context of any user viewing the collection items list, potentially leading to session hijacking, unauthorized actions, or other malicious activities within the affected application context. The vulnerability does not require user interaction beyond viewing the affected page and has a medium severity rating (CVSS 5.1).

A fix for this vulnerability is available in Cockpit CMS version 2.14.0, specifically in commit 72a83fc. Users should upgrade to version 2.14.0 or later to remediate this issue. Until upgraded, restrict permissions to prevent untrusted users from having content/:models/manage access, as this permission is required to exploit the vulnerability.