CVE-2026-27178 is a stored XSS vulnerability in MajorDoMo's shoutbox functionality. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default methods like ThisComputer.VolumeLevelChanged pass user input directly into the say() function, which stores the input raw in the database without escaping. The shoutbox widget renders these stored messages without sanitization in PHP and HTML templates. Because the dashboard widget refreshes every 3 seconds, injected scripts execute automatically when administrators load the dashboard, enabling session hijacking via cookie exfiltration.

An attacker can inject persistent malicious scripts that execute in the context of administrator users viewing the dashboard. This can lead to session hijacking through cookie theft, potentially allowing unauthorized access to administrative functions. The vulnerability requires no authentication and has a medium severity score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /objects/?method= endpoint and disable or restrict the shoutbox widget to trusted users only to reduce exposure.