CVE-2026-33061

Jexactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd inject server-side objects into client-side JavaScript through resources/views/templates/wrapper.blade.php. Using unescaped {!! json_encode(...) !!} without safe encoding flags allows string values to break out of the JavaScript context and be interpreted as HTML/JS by the browser. If any serialized fields contain attacker-controlled content, such as a username, display name, or site config value, a malicious payload will execute arbitrary script for any user viewing the page (stored DOM XSS). This issue has been patched by commit e28edb204e80efab628d1241198ea4f079779cfd.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.6 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Jexactyl/Jexactyl/commit/e28edb204e80efab628d1241198ea4f079779cfd	Patch
https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2	Exploit Vendor Advisory
https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:jexactyl:jexactyl::::::::
	cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta1::::::
	cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta2::::::
	cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta3::::::
	cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta4::::::
	cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta5::::::
	cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta6::::::
	cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta7::::::
	cpe:2.3:a:jexactyl:jexactyl:4.0.0:rc1::::::
	cpe:2.3:a:jexactyl:jexactyl:4.0.0:rc2::::::

History

14 Apr 2026, 17:56

Type	Values Removed	Values Added
References	~~() https://github.com/Jexactyl/Jexactyl/commit/e28edb204e80efab628d1241198ea4f079779cfd -~~	() https://github.com/Jexactyl/Jexactyl/commit/e28edb204e80efab628d1241198ea4f079779cfd - Patch
References	~~() https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2 -~~	() https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2 - Exploit, Vendor Advisory
First Time		Jexactyl jexactyl Jexactyl
CPE		cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta4:::::: cpe:2.3:a:jexactyl:jexactyl:::::::: cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta7:::::: cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta1:::::: cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta5:::::: cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta3:::::: cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta2:::::: cpe:2.3:a:jexactyl:jexactyl:4.0.0:rc1:::::: cpe:2.3:a:jexactyl:jexactyl:4.0.0:rc2:::::: cpe:2.3:a:jexactyl:jexactyl:4.0.0:beta6::::::

30 Mar 2026, 13:16

Type	Values Removed	Values Added
Summary		(es) exactyl es un panel de gestión de juegos y sistema de facturación personalizable. Commits después de 025e8dbb0daaa04054276bda814d922cf4af58da y antes de e28edb204e80efab628d1241198ea4f079779cfd inyectan objetos del lado del servidor en JavaScript del lado del cliente a través de resources/views/templates/wrapper.blade.php. Usar {!! json_encode(...) !!} sin escapar y sin banderas de codificación segura permite que los valores de cadena salgan del contexto de JavaScript y sean interpretados como HTML/JS por el navegador. Si algún campo serializado contiene contenido controlado por el atacante, como un nombre de usuario, nombre de visualización o valor de configuración del sitio, una carga útil maliciosa ejecutará un script arbitrario para cualquier usuario que vea la página (XSS DOM almacenado). Este problema ha sido parcheado por el commit e28edb204e80efab628d1241198ea4f079779cfd.
Summary	(en) exactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd inject server-side objects into client-side JavaScript through resources/views/templates/wrapper.blade.php. Using unescaped {!! json_encode(...) !!} without safe encoding flags allows string values to break out of the JavaScript context and be interpreted as HTML/JS by the browser. If any serialized fields contain attacker-controlled content, such as a username, display name, or site config value, a malicious payload will execute arbitrary script for any user viewing the page (stored DOM XSS). This issue has been patched by commit e28edb204e80efab628d1241198ea4f079779cfd.	(en) Jexactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd inject server-side objects into client-side JavaScript through resources/views/templates/wrapper.blade.php. Using unescaped {!! json_encode(...) !!} without safe encoding flags allows string values to break out of the JavaScript context and be interpreted as HTML/JS by the browser. If any serialized fields contain attacker-controlled content, such as a username, display name, or site config value, a malicious payload will execute arbitrary script for any user viewing the page (stored DOM XSS). This issue has been patched by commit e28edb204e80efab628d1241198ea4f079779cfd.

20 Mar 2026, 14:16

Type	Values Removed	Values Added
References	~~() https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2 -~~	() https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2 -

20 Mar 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-20 08:16

Updated : 2026-04-14 17:56

NVD link : CVE-2026-33061

Mitre link : CVE-2026-33061

CVE.ORG link : CVE-2026-33061

JSON object : View

Products Affected

jexactyl

jexactyl

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

5.8 /10