Live › vulnerability › CVE-2026-116554
Go to dashboardArgilla's settings page does not sanitize the dataset Name value when it is shown, so a crafted name can run script in another user's browser. An attacker who gets a victim to open the affected page can act as that user inside Argilla.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 23:25 UTC. All times on this page are UTC.
Teams running self-hosted Argilla 2.8.0 or earlier where users can create or edit dataset names and other users open the settings page. The sources do not say whether a patched release exists, and the project has not responded to the report.
No product ranges from the sources yet.
pip show argilla or the image tag; versions up to and including 2.8.0 are reported affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-116554")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.