The vulnerability in Uptime Kuma's Matomo analytics integration occurs because the admin-configurable Matomo siteId value is injected as a bare, unquoted JavaScript expression inside a <script> block on every public status page. This improper handling allows an attacker who can configure the siteId to execute arbitrary JavaScript in the context of any unauthenticated visitor accessing the /status/<slug> page. This cross-site scripting (CWE-79) vulnerability can be exploited to steal session cookies and take over the entire page. The CVSS 3.1 score is 8.1, indicating high severity. There is no vendor advisory or patch available at this time.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the browsers of unauthenticated visitors to the public status pages, leading to session cookie theft and full page takeover. This compromises the confidentiality and integrity of user sessions without requiring user interaction beyond visiting the affected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid entering untrusted or unvalidated values into the Matomo siteId configuration. Consider restricting access to the configuration interface to trusted users only and monitor for suspicious activity related to public status pages.