Live › vulnerability › CVE-2026-120443
GoFound through 1.4.1 lets anyone submit document text to its index API, and that text is later rendered unescaped in the admin dashboard. When an administrator's search matches the stored document, the injected script runs in the admin's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams running GoFound at or below 1.4.1 where the indexing endpoint accepts documents from people outside the admin group. The admin dashboard's search results are where the script runs, so exposure depends on whether administrators search over content that untrusted users can submit. unknown whether a patched release exists.
No product ranges from the sources yet.
/api/index endpoint is reachable from untrusted networksNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.
This page as .md · .json · in your agent: get_signal("CVE-2026-120443")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.