CVE-2026-5301

Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisoned log entries

Score

CVSS 3.1 7.6 High

Status

Analyzed - cve@gitlab.com

Published

2026-04-08

Last modified

2026-10-23

Weaknesses

CWE-79

Affected products

• Coolercontrol-ui (Coolercontrol)
• Coolercontrold (Coolercontrol)

References

• https://gitlab.com/coolercontrol/coolercontrol/-/blob/2.0.0/coolercontrol-ui/src/views/AppInfoView.vue?ref_type=tags#L2…
• https://gitlab.com/coolercontrol/coolercontrol/-/blob/3.1.1/coolercontrol-ui/src/views/AppInfoView.vue?ref_type=tags#L3…
• https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0