{"id":"CVE-2026-45627","revision":null,"records":[{"revision":"911b7249b5e9461ca2c6f43169e31b11","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45627","aliases":[],"title":"Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover","description":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> element of the embedded logo.svg, allowing an attacker to close the style block and inject executable <script> content. Because the response is served as image/svg+xml and Arcane sets no Content-Security-Policy or X-Content-Type-Options headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account. This vulnerability is fixed in 1.19.0.","state":0,"publishedAt":"2026-05-29T17:08:53.797+00:00","modifiedAt":"2026-05-29T17:31:14.391+00:00","affected":[{"ecosystem":"Vendor product","name":"arcane","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"getarcaneapp\",\n                    \"product\": \"arcane\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.19.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/getarcaneapp/arcane/security/advisories/GHSA-q2pj-8v84-9mh5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45627","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45627","identifiers":["CVE-2026-45627"]},"retained":false,"historicalAffected":[]},{"revision":"db563256fc344752bb152531fcbea1b0","observedAt":"2026-10-27T13:11:36.603+00:00","statement":{"source":"nvd","id":"CVE-2026-45627","aliases":[],"title":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via…","description":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> element of the embedded logo.svg, allowing an attacker to close the style block and inject executable <script> content. Because the response is served as image/svg+xml and Arcane sets no Content-Security-Policy or X-Content-Type-Options headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account. This vulnerability is fixed in 1.19.0.","state":0,"publishedAt":"2026-05-29T18:17:10.647+00:00","modifiedAt":"2026-10-26T13:10:00.14+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/getarcaneapp/arcane/security/advisories/GHSA-q2pj-8v84-9mh5"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45627","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-79"],"productCriteria":[],"sourceDates":{"published":"2026-05-29T18:17:10.647","lastModified":"2026-10-26T13:10:00.140"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-45627","identifiers":["CVE-2026-45627"]},"retained":false,"historicalAffected":[]},{"revision":"be1729f624d542b4923076b9e5fbad11","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-q2pj-8v84-9mh5","aliases":["CVE-2026-45627","GO-2026-5561"],"title":"Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover","description":"## Summary\n\nThe unauthenticated `GET /api/app-images/logo` endpoint reflects a user-supplied `color` query parameter into the body of an SVG document via `strings.ReplaceAll` with no escaping. The substitution lands inside a `<style>` element of the embedded `logo.svg`, allowing an attacker to close the style block and inject executable `<script>` content. Because the response is served as `image/svg+xml` and Arcane sets no Content-Security-Policy or `X-Content-Type-Options` headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account.\n\n## Details\n\nThe route is registered in `backend/internal/huma/handlers/appimages.go:53-61` with an explicitly empty security requirement, marking it as public:\n\n```go\nhuma.Register(api, huma.Operation{\n    OperationID: \"get-logo\",\n    Method:      http.MethodGet,\n    Path:        \"/app-images/logo\",\n    ...\n    Security:    []map[string][]string{}, // explicit: no auth\n}, h.GetLogo)\n```\n\n`backend/internal/huma/middleware/auth.go:209-213` honors the empty `Security` value by returning `reqs.isRequired == false` and short-circuiting with `next(ctx)`, so no JWT/API-key check runs.\n\n`GetLogoInput.Color` (`appimages.go:23`) is declared with no validation tags:\n\n```go\ntype GetLogoInput struct {\n    Full  bool   `query:\"full\" default:\"false\" ...`\n    Color string `query:\"color\" doc:\"Optional accent color override ...\"`\n}\n```\n\nThe handler passes the value straight through `getImageWithColor` → `ApplicationImagesService.GetImageWithColor` → `applyAccentColorToSVG` (`backend/internal/services/app_images_service.go:79-105`):\n\n```go\nsvgStr = strings.ReplaceAll(svgStr, \"fill:#6D28D9\", fmt.Sprintf(\"fill:%s\", accentColor))\nsvgStr = strings.ReplaceAll(svgStr, \"fill:#6d28d9\", fmt.Sprintf(\"fill:%s\", accentColor))\n```\n\nThe bundled `backend/resources/images/logo.svg` contains:\n\n```xml\n<style id=\"style1\" type=\"text/css\">.st0{fill:#6d28d9}</style>\n```\n\nso a `color` value like `red}</style><script>fetch('/api/users',...)</script><style>x{` produces a valid SVG that closes the `<style>` element and embeds a `<script>` element. The response Content-Type is `image/svg+xml` (from `pkg/utils/image/image_util.go`), and a grep of the backend confirms no `Content-Security-Policy`, `X-Content-Type-Options`, or framing headers are emitted on any route.\n\nBrowsers execute scripts in SVG documents loaded as top-level navigations or via `<iframe src=…>` / `window.open(…)`. The execution context is `origin(arcane-host)`, so the victim's `__Host-token` / `token` HttpOnly JWT cookie (recognized by `extractTokenFromCookieHeaderInternal` at `auth.go:274-286`) is automatically attached to subsequent same-origin `fetch()` calls. From there the attacker can invoke any privileged API the victim possesses — most damagingly `POST /api/users` to create a new admin account, after which the attacker has standalone admin access to manage Docker containers, registries, GitOps secrets, and SSH/registry credentials stored by Arcane.\n\n## Impact\n\n- Same-origin script execution from an unauthenticated, reachable URL — only user interaction (clicking/visiting the crafted link) is required.\n- Full session-riding against any authenticated user, including admins. Because Arcane manages Docker daemons, container exec, image registries, and GitOps repositories, an attacker who lands script execution as an admin victim can:\n  - Create persistent attacker-controlled admin accounts via `POST /api/users`.\n  - Read/modify secrets stored in environments, registries, and Git repositories the admin can access.\n  - Start or exec into containers on connected Docker hosts.\n- HttpOnly cookies do not mitigate the issue — cookies are auto-attached to same-origin `fetch()`. Absence of CSP and `X-Content-Type-Options: nosniff` removes available defenses-in-depth.\n\nDefense-in-depth — add to all responses (and especially to `/api/app-images/*`):\n\n- `X-Content-Type-Options: nosniff`\n- `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:` on the SVG image responses (or the most permissive policy compatible with the frontend on app routes).\n- Consider serving these images with `Content-Disposition: inline` and from a separate cookie-less origin to remove the same-origin session-riding primitive entirely.\n\nAlso enforce the same allowlist on the settings write path (`SettingsService` → `AccentColor`) so a stored XSS variant cannot be introduced via the settings API.","state":0,"publishedAt":"2026-05-18T14:19:26+00:00","modifiedAt":"2026-06-25T23:11:34.8239701+00:00","affected":[{"ecosystem":"Go","name":"github.com/getarcaneapp/arcane/backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.19.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/getarcaneapp/arcane/security/advisories/GHSA-q2pj-8v84-9mh5","https://nvd.nist.gov/vuln/detail/CVE-2026-45627","https://github.com/getarcaneapp/arcane"],"sourceUrl":"https://github.com/advisories/GHSA-q2pj-8v84-9mh5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q2pj-8v84-9mh5","identifiers":["GHSA-q2pj-8v84-9mh5","CVE-2026-45627","GO-2026-5561"]},"retained":false,"historicalAffected":[]},{"revision":"9a49a48482db4184a038b23caa69b1dc","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5561","aliases":["CVE-2026-45627","GHSA-q2pj-8v84-9mh5"],"title":"Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend","description":"Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-25T23:01:31.0168683+00:00","affected":[{"ecosystem":"Go","name":"github.com/getarcaneapp/arcane/backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.19.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/getarcaneapp/arcane/security/advisories/GHSA-q2pj-8v84-9mh5","https://nvd.nist.gov/vuln/detail/CVE-2026-45627"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5561","license":"OSV · upstream source license applies","key":"osv:GO-2026-5561","identifiers":["GO-2026-5561","CVE-2026-45627","GHSA-q2pj-8v84-9mh5"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T15:46:19.1555709+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T15:46:19.1555709+00:00","lastSuccessAt":"2026-10-27T15:46:19.3166108+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:19.3166123+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-67d02c0690a311a3477ecb30285e6a67bc5cbcf4b551d4b6cab698393621fd1a","complete":true,"records":415206,"lastAttemptAt":"2026-10-27T15:44:18.8922484+00:00","lastSuccessAt":"2026-10-27T15:44:18.7720642+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:44:18.8922484+00:00","snapshotPublishedAt":"2026-10-27T15:30:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T15:46:50.7636286+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13489},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T15:46:19.1555709+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T15:46:19.1555709+00:00","lastSuccessAt":"2026-10-27T15:46:21.5213865+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:21.5213883+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f81e3b22a8724ee290f14b0a1bb1aaf0","complete":false,"records":13426,"lastAttemptAt":"2026-10-27T15:46:48.5530959+00:00","lastSuccessAt":"2026-10-27T15:46:48.549+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:48.549+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13480,"expectedIdentifiers":13489},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-209ac5c5c1876448d270401dd7be9eb8338c977bffb106204e23f2a445f8dc56","complete":true,"records":9782,"lastAttemptAt":"2026-10-27T15:46:15.6695545+00:00","lastSuccessAt":"2026-10-27T15:46:15.4210182+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:15.6695545+00:00","snapshotPublishedAt":"2026-10-27T15:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T15:44:19.0567932+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:44:19.0567932+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-93fe8481574c33257e61d513a6f77ce9dae5c9ed681fabdfa367d09ba130127c","complete":true,"records":2997,"lastAttemptAt":"2026-10-27T15:46:19.1148938+00:00","lastSuccessAt":"2026-10-27T15:46:18.9862774+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:19.1148938+00:00","snapshotPublishedAt":"2026-10-27T15:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4cbf2f787207c0e5343fed347b333d6fe1c6a8461089bcb67e952c72cb90f6de","complete":true,"records":230822,"lastAttemptAt":"2026-10-27T15:46:07.9055861+00:00","lastSuccessAt":"2026-10-27T15:46:06.6649981+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:07.9055861+00:00","snapshotPublishedAt":"2026-10-27T15:18:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}