CVE-2026-52846: 
NixOS vulnerability analysis and mitigation

CVE-2026-52846 is a cross-site scripting (XSS) vulnerability in Caddy's stripHTML template function that allows malformed HTML input to bypass tag-stripping logic, potentially enabling client-side XSS attacks. It affects all versions of github.com/caddyserver/caddy/v2 up to and including 2.11.3 (and v1 up to 1.0.5 with no patch available for v1). The vulnerability was discovered manually and published on June 8, 2026, with the GitHub Advisory Database entry updated on June 16, 2026. It carries a CVSS v3.1 base score of 4.2 (Medium) (GitHub Advisory, Caddy Advisory).

The root cause is CWE-116 (Improper Encoding or Escaping of Output) in the funcStripHTML function located in caddy/caddyhttp/templates/tplcontext.go. The parser uses a state machine with inTag and inQuotes boolean flags; when it encounters a second < while already inside a tag (a "false start"), it writes the content from the first < up to the new < back into the output buffer and resets tagStart. A crafted input like <<>img src=x onerror=alert()> exploits this: the first < sets inTag=true, the second < triggers the false-start branch and writes a literal < to the output, then the > terminates the tag state — leaving a syntactically valid <img src=x onerror=alert()> tag in the output. Exploitation requires that the sanitized output be rendered as raw HTML in a browser context, and a proof-of-concept Caddyfile configuration has been publicly documented (Caddy Advisory, GitHub Advisory).

Successful exploitation allows an attacker to inject arbitrary HTML and JavaScript into pages rendered by a vulnerable Caddy instance using the templates middleware, resulting in client-side XSS. The confidentiality and integrity impacts are both rated Low — an attacker could steal session cookies, perform actions on behalf of authenticated users, or redirect victims to malicious sites. Availability is not impacted, and the scope is unchanged, meaning the attack is confined to the browser context of the victim user (GitHub Advisory).

A proof-of-concept exploit is publicly available in the official security advisory, including a complete Caddyfile configuration and template payload tested against v2.11.3 (Caddy Advisory). Exploitation requires high attack complexity (crafting specific malformed HTML) and user interaction (a victim must visit the affected page), limiting practical risk. The EPSS score is approximately 0.03–0.15%, indicating a low probability of exploitation in the wild within 30 days. There is no evidence of active in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Identify target: Locate a Caddy server (version ≤ 2.11.3) with the templates middleware enabled and a template that passes untrusted user input through the stripHTML function before rendering it as raw HTML.
2. Craft malicious input: Prepare a malformed HTML payload that exploits the false-start parser branch, e.g., <<>img src=x onerror=alert('XSS')>.
3. Inject the payload: Submit the crafted string as user-controlled input to any field or parameter that the Caddy template processes with {{ stripHTML <input> }}.
4. Trigger rendering: Cause a victim user to load the page where the template renders the sanitized (but still malicious) output as raw HTML — for example, by sharing a crafted URL or through a stored injection point.
5. Achieve XSS: The browser parses the smuggled <img src=x onerror=alert('XSS')> tag and executes the JavaScript payload, enabling session hijacking, credential theft, or further client-side attacks (Caddy Advisory).

• Network: HTTP requests containing malformed HTML patterns such as <<> or <<>img in query parameters, form fields, or request bodies directed at Caddy-served endpoints.
• Logs: Caddy access logs showing requests with URL-encoded or raw <<> sequences (e.g., %3C%3C%3E) in user-supplied parameters; repeated requests to template-rendered pages with unusual HTML-like content in inputs.
• File System: Unexpected modifications to Caddy template files (e.g., index.html) containing stripHTML calls with externally sourced input rendered without additional escaping.
• Browser/Client-Side: Unexpected JavaScript execution (e.g., alert dialogs, outbound requests to attacker-controlled domains) originating from Caddy-served pages; anomalous onerror or onload event triggers in browser developer tools (Caddy Advisory).

Upgrade Caddy to version 2.11.4 or later, which contains the fix for the funcStripHTML parser logic (Caddy Advisory). Note that Caddy v1 (≤ 1.0.5) has no patched version available; users should migrate to v2. As a workaround, avoid passing untrusted user input through stripHTML in templates, and ensure any output rendered as HTML uses context-aware escaping (e.g., Go's html/template auto-escaping) rather than relying solely on stripHTML for sanitization. Implementing additional input validation at the application layer before data reaches the template engine provides defense-in-depth.

The vulnerability was reported by researcher jmrcsnchz and published by Caddy maintainer mholt on June 8, 2026, with an AI-assisted description disclosure noted in the advisory. The advisory notes that the discovery itself was performed manually. Detection signatures have been added by Qualys (ID 692450) and Tenable Nessus (plugin 322459), indicating prompt uptake by the security tooling community (Caddy Advisory).