{"id":"CVE-2026-116229","kind":"vulnerability","aliases":["CVE-2026-116229"],"related":[],"title":"FFXIV Teamcraft: clipboard read in Electron preload enables cross-site scripting","description":"A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process IPC Bridge. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 11.4.32 is recommended to address this issue. Patch name: def118fdf36f8f3b615966893a132dd81d9cc3dc. Upgrading the affected component is recommended.","summary":"FFXIV Teamcraft up to 11.4.31 has a flaw in the clipboard.readText function of its Electron preload script, which bridges the renderer process. A remote attacker can trigger cross-site scripting through this path, and the exploit has been publicly disclosed.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","electron","ffxiv-teamcraft","package"],"not_affected_if":["web-only-use"],"how_to_check":"- Check the installed Teamcraft version; versions up to `11.4.31` are affected.\n- Look for `clipboard.readText` in `apps/electron/src/preload.ts` of the source tree.","fix":"- Upgrade FFXIV Teamcraft to `11.4.32`, which carries patch `def118fdf36f8f3b615966893a132dd81d9cc3dc`.","status":"open","published_at":"2026-10-26T08:17:17+00:00","first_seen_at":"2026-10-26T08:28:59+00:00","triaged_at":"2026-10-26T08:30:24+00:00","updated_at":"2026-10-26T08:30:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T08:30:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FFXIV Teamcraft to `11.4.32`, which carries patch `def118fdf36f8f3b615966893a132dd81d9cc3dc`.","reach":"internet","title":"FFXIV Teamcraft: clipboard read in Electron preload enables cross-site scripting","impact":"medium","summary":"FFXIV Teamcraft up to 11.4.31 has a flaw in the clipboard.readText function of its Electron preload script, which bridges the renderer process. A remote attacker can trigger cross-site scripting through this path, and the exploit has been publicly disclosed.","category":"package","nicknames":[],"who_cares":["electron","ffxiv-teamcraft","desktop"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in the app's renderer context, exposing its bridge to attacker code","analyst_note":"Confirm whether the web build is affected and what the preload bridge exposes; check the patch commit def118fdf36f8f3b615966893a132dd81d9cc3dc at the Teamcraft repository.","how_to_check":"- Check the installed Teamcraft version; versions up to `11.4.31` are affected.\n- Look for `clipboard.readText` in `apps/electron/src/preload.ts` of the source tree.","needs_analyst":true,"not_affected_if":["web-only-use"],"who_is_affected":"Users running the Electron desktop build of FFXIV Teamcraft at version 11.4.31 or earlier are exposed through the preload clipboard bridge. The sources do not say whether the web-hosted version is affected. Teams that do not run the desktop app can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":3428,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116229':15A,18A '-2026':14A,17A '11.4.31':29B,78C '11.4.32':124C 'address':128C 'affect':136C 'apps/electron/src/preload.ts':87C 'attack':49B,103C 'bridg':43B,95C 'carri':108C 'caus':98C 'clipboard':3A 'clipboard.readtext':35B,83C 'compon':90C,137C 'cross':10A,53B,99C 'cross-sit':9A,52B 'cve':13A,16A 'def118fdf36f8f3b615966893a132dd81d9cc3dc':133C 'desktop':19B 'determin':69C 'disclos':65B,116C 'electron':6A,20B,39B 'enabl':8A 'exploit':61B,112C 'ffxiv':1A,22B,25B,72C,74C 'ffxiv-teamcraft':21B,71C 'file':86C 'flaw':32B 'function':36B,82C 'impact':79C 'ipc':94C 'issu':130C 'manipul':97C 'may':118C 'name':132C 'packag':24B 'patch':131C 'path':58B 'possibl':105C 'preload':7A,40B 'process':46B,93C 'public':64B,115C 'read':4A 'recommend':126C,139C 'remot':48B,110C 'render':45B,92C 'renderer-process':91C 'script':12A,41B,55B,101C 'site':11A,54B,100C 'teamcraft':2A,23B,26B,73C,75C 'trigger':51B 'upgrad':121C,134C 'util':120C 'version':123C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Users running the Electron desktop build of FFXIV Teamcraft at version 11.4.31 or earlier are exposed through the preload clipboard bridge. The sources do not say whether the web-hosted version is affected. Teams that do not run the desktop app can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116229","severity":null,"published_at":"2026-10-26T08:17:17+00:00","modified_at":"2026-10-26T08:17:17+00:00","first_seen_at":"2026-10-26T08:28:59+00:00","fetched_at":"2026-10-26T08:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}