High · published December 17, 2025
⚡ An unauthenticated attacker can exploit the server MOTD component of Crafty Controller to perform stored XSS — think of inviting a guest who secretly comes with a hidden agenda! This vulnerability is like a mischievous prankster slipping a nasty note into your restaurant's guestbook, which then shows up on the wall for everyone to see. If you don’t check the guestbook before displaying it, that nasty surprise could ruin the mood for everyone! If exploited, an attacker could inject malicious scripts into the server MOTD, allowing them to run arbitrary code in the context of unsuspecting users. This means they could steal cookies, hijack sessions, or even perform actions on behalf of users without their consent — a recipe for chaos!
This vulnerability is like a mischievous prankster slipping a nasty note into your restaurant's guestbook, which then shows up on the wall for everyone to see. If you don’t check the guestbook before displaying it, that nasty surprise could ruin the mood for everyone! The input neutralization flaw in Crafty Controller’s server MOTD component permits remote unauthenticated attackers to inject and store harmful scripts, which are subsequently executed when the MOTD is displayed to users.
If exploited, an attacker could inject malicious scripts into the server MOTD, allowing them to run arbitrary code in the context of unsuspecting users. This means they could steal cookies, hijack sessions, or even perform actions on behalf of users without their consent — a recipe for chaos! To protect against this vulnerability, update Crafty Controller to the latest version as soon as possible and implement input validation to sanitize user inputs. Additionally, reviewing server configurations can help ensure that malicious scripts are not executed. You've got this! With a few simple updates and checks, you can keep your users safe and sound. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| craftycontrol/crafty_controller | < 4.6.2 | 4.6.2 |