Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-33061: Jexactyl panel can run malicious scripts via saved data

CVE-2026-33061 · published 7 months ago

Summary

The Jexactyl game management panel can store data that later appears in the page’s JavaScript without proper cleaning. If an attacker controls values such as usernames or settings, they can inject code that runs in any visitor’s browser. Update to the latest version that includes the patched commit to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
jexactyl	jexactyl	<= 3.8.0 4.0.0 `cpe:2.3:a:jexactyl:jexactyl::::::::`

Original advisory text

Jexactyl has Stored DOM Cross-Site Scripting (XSS) via unescaped JSON in Blade template

Jexactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd inject server-side objects into client-side JavaScript through resources/views/templates/wrapper.blade.php. Using unescaped {!! json_encode(...) !!} without safe encoding flags allows string values to break out of the JavaScript context and be interpreted as HTML/JS by the browser. If any serialized fields contain attacker-controlled content, such as a username, display name, or site config value, a malicious payload will execute arbitrary script for any user viewing the page (stored DOM XSS). This issue has been patched by commit e28edb204e80efab628d1241198ea4f079779cfd.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33061... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33061 Vendor Advisory
https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2 Vendor Advisory
https://github.com/Jexactyl/Jexactyl/commit/e28edb204e80efab628d1241198ea4f07977... Patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

5.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published20 Mar 2026

Updated26 Oct 2026

First seen20 Mar 2026

Sources

CVE-2026-33061 · NVD

CVE-2026-33061 · OSV

GHSA-6xgw-mmmv-57h2 · GHSA

Track software like this

Free during beta