The vulnerability in Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) arises from injecting the admin-configured Matomo siteId value directly into a JavaScript array push expression inside a <script> block on public status pages. The escaping mechanism used does not escape critical characters such as ], ), ;, and (, enabling an attacker to break out of the intended JavaScript context. By setting a malicious siteId value like '1]);alert(document.cookie)//', an attacker can execute arbitrary JavaScript for every unauthenticated visitor, leading to session cookie theft and full page takeover. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation allows an attacker with administrative privileges to inject arbitrary JavaScript code into public status pages, affecting all unauthenticated visitors. This can lead to session cookie theft and full page takeover of the affected pages. The vulnerability has a high severity with a CVSS score of 8.1, indicating significant confidentiality and integrity impact but no direct availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only to prevent malicious siteId injection. Monitor for updates from the vendor regarding a patch or official mitigation.