Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-33061Jexactyl has Stored DOM Cross-Site Scripting (XSS) via unescaped JSON in Blade template

Medium 5.8

In plain English

A medium-severity cross-site scripting in Jexactyl from Jexactyl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.2%top 93.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Jexactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd inject server-side objects into client-side JavaScript through resources/views/templates/wrapper.blade.php. Using unescaped {!! json_encode(...) !!} without safe encoding flags allows string values to break out of the JavaScript context and be interpreted as HTML/JS by the browser. If any serialized fields contain attacker-controlled content, such as a username, display name, or site config value, a malicious payload will execute arbitrary script for any user viewing the page (stored DOM XSS). This issue has been patched by commit e28edb204e80efab628d1241198ea4f079779cfd.

Affected products (as reported)

Vendor	Product	Versions
Jexactyl	Jexactyl	>= 025e8dbb0daaa04054276bda814d922cf4af58da, < e28edb204e80efab628d1241198ea4f079779cfd

Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2 x_refsource_CONFIRM
https://github.com/Jexactyl/Jexactyl/commit/e28edb204e80efab628d1241198ea4f079779cfd x_refsource_MISC