CVE-2026-65697 is a stored cross-site scripting vulnerability in usefathom's Fathom Lite (<=1.3.1). The vulnerability exists in the analytics collection endpoint (/collect), which accepts unauthenticated input for hostname and pathname. The parseHostname and parsePathname functions fail to validate the URI scheme, allowing an attacker to inject a javascript: URI combined with a newline-prefixed pathname. This crafted input is stored and later rendered as an anchor href in the Top Pages dashboard without sanitization. When an authenticated operator clicks the poisoned link, it enables session hijacking and full account takeover.

An unauthenticated attacker can inject malicious javascript into the analytics dashboard, which is viewed by authenticated users. This can lead to session hijacking and full account takeover of the operator's account. The vulnerability affects the confidentiality and integrity of the affected system by allowing unauthorized code execution in the context of the authenticated user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid clicking links in the Top Pages dashboard that originate from untrusted sources. Monitor vendor channels for updates and apply official patches once released.