Live › vulnerability › CVE-2026-116004
Go to dashboardOnyx, an open-source AI chat and search platform, has a cross-site scripting flaw in its craft output preview component (web/src/app/craft/components/output-panel/PreviewTab.tsx). An attacker can get script to run in a user's browser session when that preview is rendered.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 04:02 UTC. All times on this page are UTC.
Self-hosted Onyx deployments at 5.0.0 or earlier that use Craft, the output panel preview, are exposed. A user has to view crafted content in the preview, and the reported flaw is that the preview iframe is same-origin with the app, so script in it can reach the user's session. Teams that do not enable or use Craft can likely skip it. No fixed version has been published that I could find.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| onyx | github | <= 5.0.0 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116004")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.