External risk intelligence

Hydro UI Stored Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-126800

The vulnerability exists in a web application UI component that is commonly deployed as a public-facing web service. As an internet-accessible platform, the attack surface involves user-controllable input fields like profile bios that are exposed to network users, making it a likely target for public-internet-based interactions in standard deployment scenarios.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A cross-site scripting vulnerability has been identified in a user interface component that could allow malicious actors to inject script code through profile bios. This could lead to session hijacking if administrators or other users view the compromised profile. The main concern is confirming the relevance and exposure of this vulnerability to your specific environment.

Stored scripts can steal user session information.
It impacts applications with user-editable profile fields.
Assess if your systems are affected and the potential exposure.

Attack Path

How an attacker could exploit the issue

Attackers with registered user access can inject malicious scripts into their profile bios. When other users or administrators view these profiles, the script executes, potentially leading to session hijacking by stealing non-HTTPOnly session cookies.

Requires registered user access.
Stored in profile bio, triggered by viewing.
Session cookie theft for hijacking.

Live Threat

Current exploitation, exposure, and threat context

A stored cross-site scripting vulnerability could allow a registered user to inject script into their profile bio. When administrators or other users view this profile, the injected script could execute, potentially leading to session hijacking by stealing non-httpOnly session cookies.

User profile data could be compromised.
Malicious scripts could execute via profile views.
Session hijacking could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Hydro UI Default component is likely managed by the application owner or platform team, given its role in handling user-generated content and rendering it to administrators. The first practical step is to identify all instances of the affected UI component, determine their reachability and criticality, and ascertain the accountable owner for each deployment before planning remediation.

Application or Platform teams should own the issue.
Verify reachability and criticality of instances.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Hydro @hydrooj/ui-default?

Hydro is an online judge platform, and @hydrooj/ui-default is the specific software component responsible for rendering its user interface. It handles how content, such as user profiles, is displayed to visitors. This component is essential for managing user-generated data, but it also processes inputs that can influence how pages render in a browser.

How does CVE-2026-126800 work?

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw, identified as CWE-79. It occurs because the software fails to properly sanitize input when handling language-class tokens in profile fields. An attacker can save a malicious script directly into their profile bio. When another user or an administrator views that profile, the browser executes the script, which may lead to the theft of active session cookies.

Does my profile bio trigger this bug?

The vulnerability is triggered specifically by injecting double quotes into language-class tokens within your profile bio. Simply having a bio does not trigger the bug; the payload must be crafted to bypass current input filters. It will not trigger if you are the only person who ever views your own profile, as the script requires a victim to view the compromised page.

Is my Hydro instance vulnerable?

Halo Surface Signal indicates that this is a likely target because Hydro instances are typically deployed as internet-facing web services. If your installation allows public registration and displays user profiles to administrators, your environment is accessible to this type of network-based interaction. You should check if your platform is reachable from the public internet.

How do I address CVE-2026-126800?

Begin by identifying all deployments of the @hydrooj/ui-default component within your infrastructure. Once located, verify the version in use to see if it is older than 4.59.1. Coordinate with your platform or application team to confirm the current reachability of these instances and prioritize updates to the patched version as defined by the Hydro project maintainers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.