CVE-2026-39275: n/a

This vulnerability is a Cross Site Scripting (CWE-79) issue in Cockpit CMS versions 2.13.5 and before. It enables remote attackers to execute arbitrary code by injecting malicious scripts through the item.php, field-select.js, and tags.js components. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary code in the context of a victim's browser, potentially leading to data theft or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and can be exploited remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted content in affected components. Monitor vendor channels for updates and apply patches promptly once available.