---
id: "CVE-2026-117493"
kind: "vulnerability"
aliases: ["CVE-2026-117493"]
title: "BloX widgets: stored XSS via dashboard widget desc and text fields"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Cloud BI Platform", "fixed": [], "affected": "unknown (NVD: all before 27/10/2026)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["blox", "cloud-bi", "dashboards", "package", "saas", "sisense", "web", "xss"]
not_affected_if: ["no-blox-widgets", "self-hosted-without-blox"]
published_at: "2026-10-27T10:16:54+00:00"
first_seen_at: "2026-10-27T10:31:02+00:00"
updated_at: "2026-10-27T10:32:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117493", "first_seen_at": "2026-10-27T10:31:02+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T10:32:33+00:00"}]
---

# BloX widgets: stored XSS via dashboard widget desc and text fields

Stored XSS in the BloX widgets of Sisense Cloud BI Platform (SaaS). The /api/dashboards/*/widgets/* API stores HTML and JavaScript sent in the desc and text parameters. The script runs in the browser of any user who views the widget. Reported by INCIBE (CVSS v4 8.3). No fix has been reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cloud BI Platform affected unknown (NVD: all before 27/10/2026) fixed ?

## How to check

Sisense-hosted SaaS: nothing to check on your side, the platform is vendor-operated. Ask Sisense support for fix status. Review existing dashboard widgets (BloX) for HTML/script in the desc and text fields, e.g. via GET /api/dashboards/<id>/widgets.

## Fix

No fix reported as of 2026-10-27 (INCIBE: no solution reported yet). Watch Sisense's security notices; no version number is published.

## Timeline

- 2026-10-27T10:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117493
- 2026-10-27T10:32:33+00:00 analyst — Product is Sisense Cloud BI Platform (SaaS), per NVD record and INCIBE-2026-794 (CNA). No versions: NVD says 0 to 27/10/2026 (date, not a version); INCIBE says no solution reported. Not exploited, no PoC seen. Sisense's own advisory not found; nothing verified.

## Documents

- [advisory] INCIBE-CERT: Multiple vulnerabilities in Sisense's Cloud BI Platform (INCIBE-2026-794) https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platform
- [describes] NVD record CVE-2026-117493 https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-117493

## From the sources

Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_