---
id: "CVE-2026-116556"
kind: "vulnerability"
aliases: ["CVE-2026-116556"]
title: "Argilla: cross-site scripting in annotation text field component"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["argilla", "package", "python", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-26T23:16:59+00:00"
first_seen_at: "2026-10-26T23:25:48+00:00"
updated_at: "2026-10-26T23:26:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116556", "first_seen_at": "2026-10-26T23:25:48+00:00"}]
---

# Argilla: cross-site scripting in annotation text field component

Argilla up to version 2.8.0 has a cross-site scripting flaw in its annotation TextField component. A remote attacker who gets a crafted text value into a record can run script in the browser of a user who views it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Argilla version against `2.8.0`
- unknown

## Fix

- Upgrade Argilla past `2.8.0` once a fixed release is published
- unknown

## Timeline

- 2026-10-26T23:25:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116556

## From the sources

A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The manipulation of the argument text results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_