UpHeron
All vulnerabilities

Servers and applications

GHSA-j4h6-55cr-j72v

Stored XSS via unsanitized whitelabeling `customCss` (`</style>` breakout) - enterprise-license-gated; patched in canary after v0.30.5

Severity
Medium 4.8
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Cross-site scripting (CWE-79)Cross-site scripting (CWE-80)Improper output encoding (CWE-116)
Attack
Over the network · Needs an administrator account · Needs someone to click or open something
Attacker can
Read some data · Change some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Sources
Project advisories (GitHub)

Description

The enterprise "whitelabeling" feature stores an operator-supplied customCss string and injects it verbatim into a `

sequence in customCss closes the style element and allows arbitrary HTML/JS to follow (e.g. ), yielding stored cross-site scripting. Because the whitelabeling config is served by the public whitelabeling.getPublic procedure and rendered on every page - including the unauthenticated login page - the payload executes in the browser of every visitor and user.

Important scope / severity caveat (validated): both the write and the read of customCss are enterprise-license-gated. Setting it requires whitelabeling.update (an enterpriseProcedure), and the public render path (getPublicWhitelabelingConfig) returns null unless hasAnyValidLicense() is true. On an instance without a valid enterprise license this feature is inert and the vulnerability is not exploitable - so it primarily affects enterprise-licensed deployments, and the actor is a licensed instance owner/admin.

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References