Live › vulnerability › CVE-2026-116555
Go to dashboardAn unknown function in the Sandbox.vue annotation component of Argilla up to 2.8.0 mishandles the template argument, allowing cross-site scripting. An attacker who gets a crafted template into the app can run scripts in a user's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 23:25 UTC. All times on this page are UTC.
Teams running Argilla 2.8.0 or earlier with the annotation interface open to users who are not fully trusted, since the flaw is triggered through the template argument. Deployments limited to a small trusted group of annotators carry less risk. unknown whether a default configuration is exposed.
No product ranges from the sources yet.
2.8.0 and earlier are listed as affected)argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue in the deployed source if you build from itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-116555")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.