CVE-2026-126954: Glance 0.7.9 before 0.8.8 Stored XSS via Widget-Title-URL Header
Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title, reading dashboard pages through same-origin requests and exfiltrating content.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Glance deployments running version 0.7.9 through versions before 0.8.8 are affected when they use an extension endpoint controlled by an attacker.
What must an attacker control and what user action is required?
The attacker must control an extension endpoint that can return a malicious Widget-Title-URL response header. A user must click the affected widget title for the injected script to execute.
What can the injected script access?
The script can make same-origin requests to read dashboard pages and exfiltrate their content.
How should this be remediated?
Update Glance to version 0.8.8 or later.