CVE-2026-75599: HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields
HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HomeBoxto a version that resolves this vulnerability.Fixed in 0.27.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
HomeBox instances running versions before 0.27.0 are affected. Exploitation targets authenticated users who view an item page containing an attacker-controlled custom-field link and click that link.
What access and interaction does an attacker need?
The attacker needs an authenticated HomeBox account that can set an entity custom-field value. They must store a markdown-style link using a javascript: URI, and another authenticated user must click the rendered link.
Are users affected merely by viewing a malicious item page?
No. The described execution occurs when the victim clicks the rendered clickable anchor; viewing the item page alone is not stated to trigger execution.
What should be done to remediate the issue?
Upgrade HomeBox to version 0.27.0, which fixes the URL-scheme handling in the maybeUrl() utility.