{"id":"CVE-2026-117493","kind":"vulnerability","aliases":["CVE-2026-117493"],"related":[],"title":"BloX widgets: stored XSS via dashboard widget desc and text fields","description":"Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.","summary":"Stored XSS in the BloX widgets of Sisense Cloud BI Platform (SaaS). The /api/dashboards/*/widgets/* API stores HTML and JavaScript sent in the desc and text parameters. The script runs in the browser of any user who views the widget. Reported by INCIBE (CVSS v4 8.3). No fix has been reported.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Cloud BI Platform","fixed":[],"affected":"unknown (NVD: all before 27/10/2026)","ecosystem":"vendor"}],"ecosystems":[],"tags":["blox","cloud-bi","dashboards","package","saas","sisense","web","xss"],"not_affected_if":["no-blox-widgets","self-hosted-without-blox"],"how_to_check":"Sisense-hosted SaaS: nothing to check on your side, the platform is vendor-operated. Ask Sisense support for fix status. Review existing dashboard widgets (BloX) for HTML/script in the desc and text fields, e.g. via GET /api/dashboards/<id>/widgets.","fix":"No fix reported as of 2026-10-27 (INCIBE: no solution reported yet). Watch Sisense's security notices; no version number is published.","status":"open","published_at":"2026-10-27T10:16:54+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","triaged_at":"2026-10-27T10:31:55+00:00","updated_at":"2026-10-27T10:32:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T10:31:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BloX widgets: stored XSS via dashboard widget desc and text fields","impact":"medium","summary":"The BloX dashboard widget API accepts HTML and JavaScript in the desc and text parameters and stores them. The code runs in the browser of any user who views the widget, exposing data available in that browser context.","category":"package","nicknames":[],"who_cares":["blox","dashboards","web"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers, reading accessible session data","analyst_note":"Find the affected BloX versions and fixed release on the NVD entry; the sources give no version or product repo.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000494,"input_tokens":3319,"output_tokens":324,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected BloX versions and fixed release on the NVD entry; the sources give no version or product repo.","search":"'-117493':14A,17A '-2026':13A,16A '/api/dashboards':44B,92C '/widgets':45B,93C '8.3':76B 'accept':95C 'access':127C 'api':46B,94C 'bi':19A,24B,40B 'blox':1A,21B,35B,89C 'browser':63B,113C 'cloud':18A,23B,39B 'cloud-bi':22B 'code':107C 'compromis':121C 'confidenti':123C 'content':99C 'context':130C 'could':120C 'cross':84C 'cross-sit':83C 'cve':12A,15A 'cvss':74B 'dashboard':6A,25B 'desc':8A,54B,102C 'enter':108C 'execut':110C 'field':11A 'fix':78B 'html':48B,96C 'incib':73B 'inform':126C 'javascript':50B,98C 'packag':26B 'paramet':57B,105C 'platform':20A,41B 'render':118C 'report':71B,81B 'run':60B 'saa':27B,42B 'script':59B,86C 'sent':51B 'sisens':28B,38B 'site':85C 'store':3A,31B,47B,82C 'text':10A,56B,104C 'user':66B 'v4':75B 'via':5A 'view':68B 'web':29B 'widget':2A,7A,36B,70B,90C,116C 'xss':4A,30B,32B,87C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117493","severity":null,"published_at":"2026-10-27T10:16:54+00:00","modified_at":"2026-10-27T10:16:54+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","fetched_at":"2026-10-27T10:31:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117493:865","url":null,"severity":null,"published_at":"2026-10-27T10:32:33+00:00","modified_at":"2026-10-27T10:32:33+00:00","first_seen_at":"2026-10-27T10:32:33+00:00","fetched_at":"2026-10-27T10:32:33+00:00","note":"Product is Sisense Cloud BI Platform (SaaS), per NVD record and INCIBE-2026-794 (CNA). No versions: NVD says 0 to 27/10/2026 (date, not a version); INCIBE says no solution reported. Not exploited, no PoC seen. Sisense's own advisory not found; nothing verified."}],"documents":[{"id":5997,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platform","title":"INCIBE-CERT: Multiple vulnerabilities in Sisense's Cloud BI Platform (INCIBE-2026-794)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":5998,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-117493","title":"NVD record CVE-2026-117493","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}