This vulnerability (CVE-2026-5301) involves improper neutralization of input during web page generation (CWE-79) in the CoolerControl coolercontrol-ui product, specifically in versions before 4.0.0. The stored XSS flaw exists in the log viewer, enabling unauthenticated attackers to inject malicious JavaScript code into log entries. When these poisoned logs are viewed, the malicious script executes, potentially allowing attackers to take control of the service. The CVSS 3.1 base score is 7.6, indicating a high severity due to network attack vector, no privileges required, user interaction required, and impacts including low confidentiality, high integrity, and low availability.

Successful exploitation can lead to service takeover by executing arbitrary JavaScript in the context of the affected application. This compromises the integrity of the service and may allow attackers to perform unauthorized actions. Confidentiality impact is low, and availability impact is low. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor CoolerControl's official channels for updates. In the meantime, restricting access to the log viewer interface and sanitizing or validating log inputs may reduce exposure.