CVE-2026-60119 is a medium severity cross-site scripting vulnerability in Hi.Events before version 1.11.0. Authenticated attackers with permissions to create or edit events can inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence. This sequence is not escaped by JSON.stringify() when used inside inline script tags, allowing the attacker to break out of the script context in the application/ld+json structured data block or server-side rehydrated state. As a result, the malicious payload executes in the browsers of users who view the affected public event pages, potentially impacting unauthenticated visitors and administrators.

Successful exploitation allows attackers with limited authenticated privileges to execute arbitrary JavaScript in the context of users viewing the public event page. This can lead to session hijacking, defacement, or other client-side attacks targeting visitors and administrators. The vulnerability arises from improper escaping of event titles in inline scripts, enabling cross-site scripting attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict event creation and editing permissions to trusted users only and consider sanitizing or validating event titles to prevent injection of script-breaking sequences.