CVE-2026-60119 Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection

🗓️ 14 Jul 2026 15:44:34Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Authenticated attackers can inject HTML/JS via event title in Hi.Events v1.10.0-beta, causing XSS on public event pages.

Reporter	Title	Published	Views	Family All 6
cve	CVE-2026-60119	14 Jul 202615:44	–	cve
cvelist	CVE-2026-60119 Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection	14 Jul 202615:44	–	cvelist
euvd	EUVD-2026-43742	14 Jul 202615:44	–	euvd
nvd	CVE-2026-60119	14 Jul 202616:17	–	nvd
ptsecurity	PT-2026-58094	14 Jul 202600:00	–	ptsecurity
vulnrichment	CVE-2026-60119 Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection	14 Jul 202615:44	–	vulnrichment

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60119.json
github	www.github.com/HiEventsDev/Hi.Events/releases/tag/v.1.11.0-beta
github	www.github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2ggx-79g6-2jmj
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-60119
vulncheck	www.vulncheck.com/advisories/hi-events-beta-xss-via-event-title-json-stringify-injection
github	www.github.com/HiEventsDev/Hi.Events/pull/1260
github	www.github.com/HiEventsDev/Hi.Events/commit/1e36b070771801ed7113255ef7b3a7f271a2a794
github	www.github.com/HiEventsDev/Hi.Events

16 Jul 2026 03:48Current

6.3Medium risk

Vulners AI Score6.3

CVSS 45.1

EPSS0.00171