NodeBB CVE-2026-73038

Exploitation requires that the target NodeBB instance has ActivityPub/Fediverse federation enabled and its inbox endpoint is reachable by external HTTP clients. No authentication on the NodeBB instance is required by the attacker - only control of an ActivityPub-capable endpoint to deliver the crafted Create/Note activity. Victim users must view a post or thread containing the malicious emoji tag content to trigger JavaScript execution in their browsers, consistent with UI:P in the CVSS 4.0 vector. Exploitation is NOT possible on NodeBB instances where ActivityPub federation is disabled. Instances that are firewalled from inbound external ActivityPub traffic or that run without federation configuration are not affected.

The CVSS 4.0 score of 5.3 (Medium) is appropriate for the vulnerability class: the attack is network-accessible with no authentication or special preparation (AV:N/AC:L/AT:N/PR:N), but requires a passive victim to view the poisoned post (UI:P) and impacts are bounded to subsequent-system scope (SC:L/SI:L/SA:N), meaning the NodeBB server itself is not directly compromised (VC:N/VI:N/VA:N). A key risk amplifier is the stored nature of the payload - a single malicious ActivityPub delivery poisons every future viewer of the affected thread, multiplying impact proportionally with forum traffic. No EPSS score was provided in the input data; this represents a gap in probabilistic exploitation assessment. The CVE is not listed in CISA KEV, and no POC code was identified, indicating no confirmed widespread active exploitation at time of analysis. Real-world risk is gated on whether ActivityPub federation is enabled, which may not be the default in all deployments; operators who have never activated Fediverse integration are not exposed. High-traffic forums with open federation face meaningfully higher aggregate risk than the moderate base score implies, and patching should be treated as urgent in those environments.

An attacker controlling any ActivityPub-compatible server - or capable of crafting raw signed HTTP ActivityPub requests - sends a Create/Note activity to the target NodeBB instance's federation inbox, embedding a malicious payload in the tag.icon.url or tag.name field of a custom emoji object. NodeBB stores the unescaped content and renders it for every subsequent user who views the affected thread, executing the attacker's JavaScript in their browsers and potentially enabling session token theft, credential phishing overlays, or lateral propagation to other forum users.