EUVD-2026-78591
GHSA-wwf9-7jrc-rv4q
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
AV:L reflects purely client-side execution with no network reachability; PR:N since no role gatekeeps Text Widget authorship; UI:R because a second user must view the dashboard.
Primary rating from Vendor (https://github.com/outerbase/studio).
CVSS VectorVendor: https://github.com/outerbase/studio
Lifecycle Timeline
3DescriptionCVE.org
Summary
A Stored Cross-Site Scripting (XSS) issue previously existed in the Text Widget in Board of Outerbase Studio where unsanitized HTML could be rendered using dangerouslySetInnerHTML
Steps to Reproduce
- Create a new dashboard.
- Add a Text widget.
- Insert the following payload:
<img src=x onerror="alert('XSS Executed\nToken: ' + localStorage.getItem('ob-token'))">Architectural Context
Outerbase Cloud and its backend services were discontinued in 2025.
The current version of Outerbase Studio operates purely as a client-side application, with dashboard data stored locally in the browser.
Impact
In the current architecture, the impact is limited to local self-XSS within a user's browser session. The previously described scenarios involving:
- authentication token theft
- account takeover
- database access
are no longer applicable since there are no active backend services or authentication tokens.
Remediation
The unsafe HTML rendering in the Text Widget has been removed in commit https://github.com/outerbase/studio/commit/b06fb85e5967440278d5a815721b360920566ab9 by eliminating the use of dangerouslySetInnerHTML.
AnalysisAI
Stored XSS in Outerbase Studio's Text Widget (npm/@outerbase/studio <= 0.10.2) allowed arbitrary HTML injection through React's dangerouslySetInnerHTML, enabling script execution in any user who viewed a malicious dashboard. The real-world severity is substantially reduced from legacy disclosures: Outerbase Cloud was discontinued in 2025, leaving the application as a purely client-side tool with no backend, no shared sessions, and no persistent authentication tokens - eliminating the originally described token-theft and account-takeover scenarios. No public exploit identified at time of analysis, though the advisory itself contains a functional reproduction payload.
Technical ContextAI
Outerbase Studio (pkg:npm/@outerbase_studio) is a React-based, client-side SQL workspace. The Text Widget component used a custom markdown-to-HTML pipeline that substituted patterns like bold into raw <b> tags via regex replacements on a mutable string, then passed the resulting string directly to React's dangerouslySetInnerHTML. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: user-supplied text was transformed into HTML fragments without sanitization, so injection of event-handler attributes (e.g., onerror on a broken img tag) bypassed the intended markdown rendering entirely. The vulnerable code in src/components/chart/index.tsx has been replaced with a plain text rendering path (<span>{markdown}</span>) that bypasses HTML parsing altogether.
RemediationAI
The upstream fix is available as commit b06fb85e5967440278d5a815721b360920566ab9 (https://github.com/outerbase/studio/commit/b06fb85e5967440278d5a815721b360920566ab9), which removes the dangerouslySetInnerHTML rendering path in the Text Widget and replaces it with React's safe text-node rendering. No tagged release version incorporating this fix has been independently confirmed - the fixed-in field in the NVD record is absent, meaning consumers should track the repository directly for a patched npm release above 0.10.2. As a compensating control until a patched release is available, restrict the ability to create or import dashboards to trusted operators only, and avoid using the Text Widget in shared or embedded contexts. For self-hosted deployments, pinning the dependency to the post-commit build or forking and patching locally are viable interim approaches with no known functional side effects on core query features.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today