Stored Cross-Site Scripting Vulnerability in Hydro @hydrooj/ui-default
CVE-2026-126800

9.3CRITICAL

Key Information:

Vendor

Hydro-dev

Status
@hydrooj/ui-default
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126800?

The Hydro @hydrooj/ui-default library prior to version 4.59.1 contains a stored cross-site scripting vulnerability. This issue allows registered users to inject malicious scripts by manipulating double quotes in language-class tokens within the markdown-it-xss.ts file. Consequently, attackers can embed a payload in their profile bio, which activates when other users, including administrators, access the profile, potentially leading to the theft of the non-httpOnly session identifier cookie and facilitating session hijacking.

Affected Version(s)

@hydrooj/ui-default 0 < 4.59.1

References

https://github.com/hydro-dev/Hydro/commit/3bae56fe8edddff...
patch
https://github.com/hydro-dev/Hydro/blob/3c8286dd1350fcd00...
technical-description
https://vul.yulun.ac.cn/20261107/hydro/
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.