CyberRota Analysis
AI-GeneratedFathom Lite versions up to 1.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw in the analytics collection endpoint, allowing unauthenticated attackers to inject malicious JavaScript into the Top Pages dashboard. This vulnerability can lead to session hijacking and full account takeover when an authenticated user interacts with the compromised dashboard entry. Organizations using Fathom Lite should prioritize patching this vulnerability to protect their systems from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint. The parseHostname and parsePathname functions perform no URI scheme validation, allowing a javascript: hostname combined with a newline-prefixed pathname to be stored and later rendered as an anchor href in the authenticated dashboard without sanitization, enabling session hijacking and full account takeover when an operator clicks the poisoned entry.