CVE-2026-75599Medium· 5.4▾ SunlitHomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.
homebox < 0.27.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85287Medium· 6.5HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
CVE-2026-85286Low· 3.7HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
CVE-2026-116680Medium· 6.4Homebox generic notifier SSRF via HTTP redirect after URL validation
CVE-2026-55473Medium· 6.0HomeBox is a home inventory and organization system
CVE-2026-48826High· 8.1HomeBox is a home inventory and organization system
CVE-2026-48976High· 8.1HomeBox is a home inventory and organization system