Skip to main content

NodeBB CVE-2026-73038

| EUVDEUVD-2026-58226 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-13 VulnCheck GHSA-fh4m-97qj-ff6c
XSS Nodebb
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

Network-delivered stored XSS with no auth required; scope changes to victims' browsers enabling JS execution; no server-side availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 13, 2026 - 19:21 vuln.today
Analysis Generated
Aug 13, 2026 - 19:21 vuln.today

DescriptionCVE.org

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers.

AnalysisAI

Stored cross-site scripting in NodeBB before 4.15.0 allows any federated ActivityPub actor to inject persistent malicious JavaScript into forum posts viewed by all subsequent users. The renderEmoji function fails to HTML-encode tag.icon.url and tag.name values sourced from incoming ActivityPub Create/Note objects before writing them into stored post content, creating a durable XSS sink reachable from the open Fediverse. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Control ActivityPub-capable server or endpoint
Delivery
Craft Create/Note activity with malicious tag.icon.url or tag.name payload
Exploit
Deliver signed activity to NodeBB federation inbox
Execution
NodeBB renderEmoji stores unsanitized HTML in post content
Persist
Victim user views affected post
Impact
Injected JavaScript executes in victim browser
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target NodeBB instance has ActivityPub/Fediverse federation enabled and its inbox endpoint is reachable by external HTTP clients. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 (Medium) is appropriate for the vulnerability class: the attack is network-accessible with no authentication or special preparation (AV:N/AC:L/AT:N/PR:N), but requires a passive victim to view the poisoned post (UI:P) and impacts are bounded to subsequent-system scope (SC:L/SI:L/SA:N), meaning the NodeBB server itself is not directly compromised (VC:N/VI:N/VA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker controlling any ActivityPub-compatible server - or capable of crafting raw signed HTTP ActivityPub requests - sends a Create/Note activity to the target NodeBB instance's federation inbox, embedding a malicious payload in the tag.icon.url or tag.name field of a custom emoji object. NodeBB stores the unescaped content and renders it for every subsequent user who views the affected thread, executing the attacker's JavaScript in their browsers and potentially enabling session token theft, credential phishing overlays, or lateral propagation to other forum users.
Remediation The primary fix is upgrading to NodeBB v4.15.0 or later, released 2026-08-12, which adds emoji icon URL validation before rendering via commit c0d94a217edcafcdb9b3920a6e80935194bcb19e. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nodebb

View all
CVE-2023-43187 CRITICAL POC
9.8 Sep 27

A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.1
CVE-2026-58593 HIGH POC
8.7 Jul 01

Author spoofing in NodeBB's ActivityPub federation allows a remote federated actor to forge posts and private messages a
CVE-2022-36076 HIGH POC
7.5 Sep 02

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Rated high sev
CVE-2021-43786 HIGH POC
7.5 Nov 29

Nodebb is an open source Node.js based forum software. Rated high severity (CVSS 7.5), this vulnerability is remotely ex
CVE-2021-43787 MEDIUM POC
6.1 Nov 29

Nodebb is an open source Node.js based forum software. Rated medium severity (CVSS 6.1), this vulnerability is remotely

CVE-2020-15149 CRITICAL
9.9 Aug 20

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to ch
CVE-2023-26045 CRITICAL
9.8 Jul 24

NodeBB is Node.js based forum software. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,

CVE-2022-46164 CRITICAL POC
9.8 Dec 05

NodeBB is an open source Node.js based forum software. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2022-36045 CRITICAL
9.8 Aug 31

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Rated critical
CVE-2024-57041 MEDIUM POC
4.6 Jan 24

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code

CVE-2021-43788 MEDIUM POC
5.0 Nov 29

Nodebb is an open source Node.js based forum software. Rated medium severity (CVSS 5.0), this vulnerability is remotely

CVE-2022-3978 MEDIUM POC
4.3 Nov 13

A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. Rated medium severity (CVSS 4.3),

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-73038 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy