EUVD-2026-26244Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Registered account required (PR:L), victim must view content (UI:R), payload affects other users including admins (S:C); no availability impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML notification emails sent to other users.This issue affects helpy: 2.8.0.
AnalysisAI
Stored cross-site scripting in Helpy 2.8.0 allows any registered user to persist arbitrary HTML in their account display name, which renders unescaped across three distinct surfaces: public forum threads, the admin ticket view, and HTML notification emails sent to other users. The multi-surface persistence is the key risk amplifier - a single malicious account name can target both end-users and privileged administrators without further action by the attacker. No active exploitation is confirmed (SSVC: none; EPSS: 0.05%), making this a medium-priority issue requiring a registered attacker account and victim interaction.
Technical ContextAI
Helpy is an open-source Ruby-on-Rails customer support helpdesk platform identified by CPE cpe:2.3:a:helpy.io:helpy:2.8.0. The flaw is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) defect: the post author display logic writes the account name field to persistent storage and later renders it directly into HTML output - in forum thread templates, the admin ticket UI, and outbound email body - without applying HTML entity encoding. The three rendering paths suggest the name field is retrieved and interpolated in multiple view templates, none of which apply an escape filter. The email vector is particularly notable because it extends XSS payloads beyond the browser security model into mail clients that render HTML.
RemediationAI
No vendor-released patched version has been identified at time of analysis. Operators should monitor https://github.com/helpyio/helpy for a fix release and apply it immediately when available. As a compensating control, administrators should audit the Rails view templates responsible for rendering author display names in forum threads, ticket views, and email partials, and ensure all interpolations use HTML-safe escaping (e.g., Rails h() helper or ERB's <%= %> with auto-escaping enabled). Restricting user self-registration to invite-only or administrator-approved workflows removes the unauthenticated path to account creation and significantly narrows the attacker pool. Switching notification emails from HTML to plain-text format eliminates the email attack surface entirely, with the trade-off of reduced visual formatting. Until a patch is available, reviewing new account display names for suspicious HTML characters upon registration provides a weak but practical detective control.
Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. Rated medium
Stored cross-site scripting in Helpy 2.8.0's knowledge base Doc rendering logic allows authenticated admin or agent edit
Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today