Live › vulnerability › CVE-2026-116556
Go to dashboardArgilla up to version 2.8.0 has a cross-site scripting flaw in its annotation TextField component. A remote attacker who gets a crafted text value into a record can run script in the browser of a user who views it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 23:25 UTC. All times on this page are UTC.
Teams running self-hosted Argilla up to and including 2.8.0 where annotators or reviewers open datasets that contain untrusted text. The sources do not say whether a fixed version exists or whether the project has responded. Deployments that do not expose the annotation interface to untrusted data have less exposure.
No product ranges from the sources yet.
2.8.02.8.0 once a fixed release is publishedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The manipulation of the argument text results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-116556")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.