CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint
Unauthenticated attackers can inject JavaScript via the /collect endpoint, leading to session hijacking and account takeover when operators view the dashboard.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-65697?
CVE-2026-65697 is a medium-severity cross-site scripting vulnerability in usefathom fathom, published on 23 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint. The parseHostname and parsePathname functions perform no URI scheme validation, allowing a javascript: hostname combined with a newline-prefixed pathname to be stored and later rendered as an anchor href in the authenticated dashboard without sanitization, enabling session hijacking and full account takeover when an operator clicks the poisoned entry.
Weakness: CWE-79
Which versions are affected by CVE-2026-65697?
How do I fix CVE-2026-65697?
No fix has been published for CVE-2026-65697 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-65697 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65697 exists.
Sources
Also known as GHSA-4fpj-4rcv-h3hf.