CVE-2026-27178
Published: 18 February 2026
Summary
CVE-2026-27178 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Mjdm Majordomo. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-27178 is a stored cross-site scripting (XSS) vulnerability in MajorDoMo (also known as Major Domestic Module), affecting the shoutbox component. The issue stems from method parameter injection at the /objects/?method= endpoint, which permits unauthenticated execution of stored methods using attacker-controlled parameters. Default methods, such as ThisComputer.VolumeLevelChanged, pass the user-supplied VALUE parameter directly into the say() function. This stores the raw message in the shouts database table without escaping, and the shoutbox widget renders these messages without sanitization in both PHP code and HTML templates.
Unauthenticated attackers can exploit the vulnerability by injecting malicious payloads via the endpoint. The shoutbox widget on the dashboard auto-refreshes every 3 seconds, causing the injected script to execute automatically whenever an administrator loads the dashboard. This enables session hijacking through cookie exfiltration. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and maps to CWE-79.
Advisories recommend applying the patch provided in GitHub pull request #1177 at https://github.com/sergejey/majordomo/pull/1177. Further details on the vulnerability and mitigation are available in the chocapikk blog post at https://chocapikk.com/posts/2026/majordomo-revisited/ and the VulnCheck advisory at https://www.vulncheck.com/advisories/majordomo-stored-cross-site-scripting-via-method-parameters-to-shoutbox.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8375
Vulnerability details
MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default methods such as ThisComputer.VolumeLevelChanged pass the user-supplied VALUE…
more
parameter directly into the say() function, which stores the message raw in the shouts database table without escaping. The shoutbox widget renders stored messages without sanitization in both PHP rendering code and HTML templates. Because the dashboard widget auto-refreshes every 3 seconds, the injected script executes automatically when any administrator loads the dashboard, enabling session hijack through cookie exfiltration.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing web app enables unauthenticated script injection that auto-executes in admin browsers, directly facilitating T1190 (exploit public-facing app), T1185 (browser session hijacking), and T1539 (steal web session cookie via exfiltration).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of all input parameters (including VALUE at /objects/?method=) before they reach say() and the shouts table, blocking the stored XSS payload.
Requires filtering or encoding of all output rendered by the shoutbox widget and PHP/HTML templates, preventing execution of attacker-controlled script when the dashboard auto-refreshes.
Enforces authorization checks on the /objects/?method= endpoint so that unauthenticated callers cannot invoke stored methods such as ThisComputer.VolumeLevelChanged with arbitrary parameters.