CVE-2026-113712: Cachet has Stored XSS in Incident Component

October 20, 2026

A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.

References

github.com/advisories/GHSA-x397-5hrv-j9m9
github.com/cachethq/cachet/security/advisories/GHSA-x397-5hrv-j9m9
github.com/cachethq/core/commit/23adbb88ffa819f92be4a905ff1d812670d980a2
github.com/cachethq/core/commit/57b44a8bac0b250b0d5751e93e0349070d14606e
nvd.nist.gov/vuln/detail/CVE-2026-113712

Code Behaviors & Features

Detect and mitigate CVE-2026-113712 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →