EUVD-2026-109330
GHSA-f3f8-mxmv-8237
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Onyx user
-
DeliveryInject script payload into Craft content
-
ExploitPayload stored/reflected in PreviewTab output
-
ExecutionVictim views preview, script executes in browser
-
ImpactIntegrity impact within victim session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account on the Onyx instance (CVSS PR:L) and passive interaction by a victim user who views the Craft feature's output panel (UI:P) - specifically content rendered by PreviewTab.tsx. It is bounded to Onyx versions up to and including 5.0.0. Limiting factors that reduce real-world risk: the attacker cannot act fully unauthenticated, a second user must render the malicious preview for the payload to fire, and the vendor-assessed impact is integrity-only (no confidentiality or availability loss). The exact injection source (which input flows into the preview) is not detailed in the available sources. |
| Impact | This is a moderate-severity stored/reflected cross-site scripting flaw (CWE-79) in Onyx's Craft output panel (PreviewTab.tsx), assessed by VulDB at CVSS 5.1 using the 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. The signals are internally consistent and point to a real but bounded issue rather than a drop-everything emergency: the vector is network-reachable with low attack complexity, but it requires an authenticated low-privileged account (PR:L) and passive victim interaction (UI:P), and the impact is confined to low integrity (VI:L) with no confidentiality or availability loss claimed by the vendor. It is NOT in CISA KEV, so there is no evidence of active exploitation; the E:P maturity flag and the public disclosure in the description indicate proof-of-concept-level exploit information rather than confirmed weaponization. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in - this is a missing signal. The vuln.today decision label is 'this_month', which aligns with a prioritize-but-not-emergency posture. A notable aggravating factor is that the vendor was contacted but did not respond, so no coordinated fix or advisory timeline is confirmed. Net: a genuine but lower-tier priority gated by authentication and user interaction. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged authenticated Onyx account (≤5.0.0) submits crafted content that is rendered without proper sanitization in the Craft output panel's PreviewTab. When another user passively views that preview, the injected script executes in their browser session within the Onyx application. A public PoC reference exists (disclosed via VulDB and a GitHub security advisory); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 25, 2026
Cross-site scripting (CWE-79) in the Onyx chat/knowledge platform through version 5.0.0, specifically in the Craft feature's output panel rendered by web/src/app/craft/components/output-panel/PreviewTab.tsx, lets an attacker inject script that executes in the browser context of another user who views the crafted preview. Exploitation requires a low-privileged authenticated account on the Onyx instance plus a victim who renders the malicious preview, and the vendor-assessed impact is limited to integrity (no confidentiality or availability loss), which is why VulDB scored it 5.1; a public exploit disclosure accompanies the report, but it is not independently verified as working exploit code, and there is no KEV listing or evidence of active exploitation. Onyx administrators should treat this as a moderate-priority hardening item to be scheduled within the current month rather than an emergency.
RemediationAI
No vendor-released patch identified at time of analysis: the reporter states the vendor was contacted early and did not respond, and no fixed version number appears in the available data, so there is no exact upgrade target to cite - check https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-grhq-88h5-2h86 and the project at https://github.com/onyx-dot-app/onyx/ for a fix before upgrading. Until a patched release is confirmed, apply targeted compensating controls: restrict who can use the Craft feature or reach the output-panel preview route (for example by limiting Craft access to trusted, vetted accounts), which shrinks the pool of potential attackers but does not remove the flaw; front Onyx with a reverse proxy or WAF rule that strips or blocks injected script in Craft preview responses, accepting that such filters are bypassable and can cause false positives on legitimate content; and enforce a strict Content-Security-Policy that disallows inline script on the Onyx origin, which materially blunts XSS payloads but may break features relying on inline scripts and must be tested before rollout. Because the exploitation prerequisites are an authenticated low-privileged account plus a victim viewing the crafted preview, reviewing who holds accounts on the instance and monitoring for suspicious Craft preview content are the most directly applicable interim steps.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Onyx is a self-hosted AI chat and knowledge-search application; the affected component sits in the Next.js/React frontend at web/src/app/craft/components/output-panel/PreviewTab.tsx, part of the 'Craft' feature that previews generated or user-supplied output. The root cause class is CWE-79 (improper neutralization of user-controllable input before it is placed in output used as a web page), i.e. content reaching the preview rendering path is not adequately sanitized or escaped before the browser interprets it. The CVSS 4.0 vector supplied by the reporter (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) and the independently assessed 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that the attack is network-reachable but gated behind a low-privileged account and a second user's passive interaction, with limited integrity impact. The precise input that flows into PreviewTab.tsx and the exact sink are not described in the available sources, so the trigger mechanism beyond 'malicious preview content rendered in the Craft output panel' is unconfirmed. The CPE cpe:2.3:a:onyx-dot-app:onyx:*:*:*:*:*:*:*:* indicates the wildcarded version range applies, bounded by the reporter at 5.0.0 and below.
Know when Onyx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Authenticated low-priv user (PR:L) injects script executed in another user's browser requiring their interaction (UI:R), crossing into the browser security context (S:C) with limited confidentiality and integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search p
Cross-user credential disclosure in Onyx (open-source AI platform) lets any low-privileged BASIC_ACCESS user retrieve an
NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cau
NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a us
NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter
Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. Rate
Credential disclosure in Onyx 4.6.6 allows any authenticated user to retrieve plaintext API keys and authorization heade
Privilege escalation in Onyx Enterprise Edition (versions prior to 4.3.0) allows any authenticated curator to modify use
Onyx versions prior to 3.0.9, 3.1.6, and 3.2.6 expose an authorization bypass in the GET /chat/file/{file_id} endpoint t
SQL injection in Onyx Chat Interface allows authenticated remote attackers to manipulate database queries via the genera
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary Ja
Onyx versions before 3.0.9, 3.1.6, and 3.2.6 permit authenticated users to terminate any other user's active chat sessio
Exploit-DB