GoFound CVE-2026-120443

The attacker must be able to reach the /api/index endpoint and submit document text without authentication (PR:N), and that text must contain HTML/script that gets stored in the GoFound index. The payload is inert until an administrator logs into the GoFound dashboard and performs a search that matches the malicious document - only then does searcher/engine.go return the stored content unescaped and dashboard.vue render it with v-html, triggering execution (UI:A). Limiting factors: exploitation depends entirely on that admin search interaction, impact is scoped to the administrator's browser session rather than the server, and the affected software is version 1.4.1 and earlier of a niche product with limited deployment.

Signals point to a genuine but moderate, interaction-gated issue rather than a drop-everything emergency. The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, 5.1 Medium) describes unauthenticated, network-reachable injection with low attack complexity and no attack requirements, but crucially requires active user interaction (UI:A): the payload only fires when an administrator runs a dashboard search that matches the attacker's indexed document. My independent CVSS 3.1 assessment is 6.1 (scope-changed stored XSS), consistent with that reading. No EPSS score and no KEV listing were provided, so there is no evidence of active exploitation or quantified exploitation probability; the vuln.today Decision label is this_month, i.e. a prioritize-and-schedule item, not act_now or emergency. A public PoC reference exists but is not verified as working exploit code, so exploit maturity is unconfirmed. The impact is confined to the administrator's browser session (SC:L/SI:L, no confidentiality/integrity/availability impact to the server itself, VC/VI/VA:N), and the affected product (sea-team GoFound) has a small deployment footprint. Net: a real, patch-worthy stored XSS that can hijack an admin session, but its reach is limited by the required admin search interaction and the product's niche adoption.

An unauthenticated attacker sends a document containing malicious HTML/JavaScript to the /api/index endpoint, which GoFound stores in its index. When an administrator later performs a dashboard search whose results match that document, searcher/engine.go returns the stored text unescaped and dashboard.vue renders it via v-html, executing the attacker's script in the admin's authenticated browser session. A public PoC reference exists but is not verified as working exploit code.