EUVD-2026-26245Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects mandatory admin/agent editor role to write; S:C because stored payload executes in a different user's browser context; UI:R because victim must view the Doc; no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor privileges can persist arbitrary HTML or JavaScript in the body field of a knowledge base Doc.This issue affects helpy: 2.8.0.
AnalysisAI
Stored cross-site scripting in Helpy 2.8.0's knowledge base Doc rendering logic allows authenticated admin or agent editor accounts to persist arbitrary JavaScript in Doc body fields, which then executes silently in the browsers of any user who views the affected page. The vulnerability is confirmed in version 2.8.0 per CPE cpe:2.3:a:helpy.io:helpy:2.8.0 and the Fluid Attacks advisory (EUVD-2026-26245). No active exploitation has been identified - EPSS sits at 0.04% (13th percentile) and CISA KEV lists no known threat actor activity - but the stored nature of the payload means a single injection persists for all subsequent victims without further attacker interaction.
Technical ContextAI
Helpy is an open-source customer support and knowledge base platform (cpe:2.3:a:helpy.io:helpy:2.8.0), hosted at https://github.com/helpyio/helpy. The flaw resides in the rendering pipeline for knowledge base Doc body content, which fails to neutralize attacker-supplied HTML and JavaScript before inserting it into the DOM for viewers. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) identifies the root cause: stored user input is serialized to the database and later rendered unsanitized, making this a persistent (Type 2) XSS variant. Unlike reflected XSS, stored XSS requires no social engineering link delivery per victim - any user browsing to the poisoned Doc triggers the payload passively. The knowledge base feature implies a broad internal readership (customers, agents, admins), amplifying downstream exposure once a payload is planted.
RemediationAI
No vendor-released patched version has been identified in the available data at time of analysis; the upstream repository at https://github.com/helpyio/helpy should be monitored for a tagged release or fix commit that addresses the body field sanitization. Until a patch is available, restrict admin and agent editor roles strictly to fully trusted personnel and enforce multi-factor authentication on those accounts to reduce the risk of credential-based privilege abuse - this does not eliminate the flaw but removes the most likely attack path. Deploy a Content Security Policy (CSP) header that restricts script execution to known origins (e.g., script-src 'self'), which can neutralize injected payload execution even if content is successfully stored; note that overly strict CSP rules may break legitimate rich-text or embedded-media functionality in the knowledge base and require tuning. Additionally, audit existing knowledge base Doc body content for embedded script tags or event handler attributes as a remediation step. Cite the Fluid Attacks advisory (https://fluidattacks.com/es/advisories/prisioneros) when engaging the vendor for a fix timeline.
Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. Rated medium
Stored cross-site scripting in Helpy 2.8.0 allows any registered user to persist arbitrary HTML in their account display
Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today