FFXIV Teamcraft CVE-2026-116229

Exploitation requires a low-privileged authenticated account (PR:L) able to submit comment content, and requires a victim to view the affected DB comment page (UI:P / passive user interaction). The concrete trigger demonstrated by the patch is that user-supplied comment text was passed through DomSanitizer.bypassSecurityTrustHtml and rendered as trusted HTML; the fix converts comments into text and link segments so they are never turned into HTML. Note the description instead cites clipboard.readText in the Electron preload IPC bridge, so the exact entry point is not consistently described across sources. Limiting factors: an account is needed to deliver the payload, a second user must open the content for it to fire, and only the fixed version 11.4.32 removes the unsafe HTML path - these reduce realistic impact below the raw network-vector reading.

This is a medium-severity stored cross-site scripting issue (CVSS 4.0 base 5.1, CWE-79) with modest real-world urgency. The CVSS vector AV:N/AC:L/PR:L/UI:P indicates network-reachable, low-complexity exploitation that requires an authenticated low-privileged account (PR:L) and passive victim interaction (UI:P), with only limited integrity impact (VI:L) and no confidentiality or availability impact (VC:N/VA:N). The input provides no EPSS score, so statistical exploitation probability cannot be weighed. The vulnerability is NOT on CISA KEV, and the exploit entry is a reference only, not verified working exploit code, which is consistent with the CVSS exploit-maturity flag E:P (proof-of-concept). The vuln.today decision label is 'this_month' - meaningful but not emergency. A notable conflict exists in the source data: the textual description attributes the flaw to the function clipboard.readText in apps/electron/src/preload.ts (Renderer-Process IPC Bridge), whereas the actual vendor patch commit modifies apps/client/src/app/pages/db/db-comments/comment-links.pipe.ts and removes a DomSanitizer.bypassSecurityTrustHtml call that rendered user comment text as HTML - verify the true sink with the vendor, as the described location and the patched location do not match. Overall this reads as a genuine but lower-priority web XSS requiring an account and user interaction, not a high-CVSS-but-trivially-wormable mass-exploitation threat.

An authenticated user posts a crafted comment on a Teamcraft database entry containing malicious markup that the comment-rendering pipeline previously trusted as safe HTML. When another user views that comment page, the injected script executes in the application's renderer context. A public PoC reference exists (a Google Drive link) but it is not verified as working exploit code.