EUVD-2026-110499
GHSA-3vhh-v9v8-vm2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Argilla instance
-
DeliverySet XSS payload in dataset Name
-
ExploitVictim opens dataset settings page
-
ExecutionStored script executes in victim browser
-
ImpactAbuse victim session/actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the target Argilla instance with privileges to create or edit a dataset, because the injection point is the dataset Name argument. The stored payload executes only when another user loads the affected dataset's Settings page (SettingsInfo.vue), so victim interaction is required (UI:P in the supplied vector). Limiting factors: authentication is required (PR:L, not unauthenticated), a victim must view the settings page, and only Argilla versions up to and including 2.8.0 are affected; because the project has not responded, no patched version is currently available, and the available sources do not describe a non-default configuration being needed. |
| Impact | This is a low-priority, low-severity issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) scores only 2.0: it describes network reach but requires an authenticated low-privileged account (PR:L) and victim interaction (UI:P), with only a limited integrity impact and no confidentiality or availability impact. EPSS agrees it is unlikely to see broad exploitation (0.25%, 17th percentile), and the vuln.today Decision label is 'monitor' - not act_now or emergency. It is NOT in CISA KEV, so there is no confirmed active exploitation. The description claims 'The exploit has been published and may be used,' but the multi-source intelligence qualifies this: a public PoC reference exists (github.com/3em0/cve_repo) and it is not verified as working exploit code, so POC availability should not be read as weaponization. One notable gap: the project was notified via GitHub issue #5875 but has not responded, so no vendor-confirmed fix exists. Net: a genuine stored-XSS bug but a low real-world priority - authentication plus user interaction requirements, limited impact, low EPSS, and a 'monitor' label all point away from urgency. |
| Exploit ScenarioDerived | An authenticated low-privileged user of an Argilla instance (≤2.8.0) creates or renames a dataset, placing a cross-site scripting payload in the dataset Name field. The payload is stored and later rendered unescaped in the SettingsInfo.vue settings page, so it executes in the browser of any user who views that dataset's settings. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Stored cross-site scripting in Argilla 2.0 through 2.8.0 allows a user who can create or edit a dataset to inject script into the dataset Name field, which then executes in the browser of another user who opens that dataset's Settings page (SettingsInfo.vue). Because the injection point is the dataset name, an attacker needs an authenticated account with dataset-creation privileges (PR:L) and the victim must actually load the affected settings view (UI:P), which keeps the practical impact narrow; the CVSS 4.0 score is 2.0 and EPSS is only 0.25% (17th percentile), so the vulnerability is tracked as monitor priority. No vendor patch exists at time of analysis - Argilla was notified through GitHub issue #5875 and has not responded - and a public PoC reference exists; it is not verified as working exploit code.
RemediationAI
No vendor-released patch was identified at time of analysis: Argilla was notified via GitHub issue #5875 and has not responded, and no fixed version is listed in any supplied source, so upgrading is not yet an available fix and the issue should be tracked at https://github.com/argilla-io/argilla/issues/5875 until a release addresses it. Because exploitation requires an account that can create or edit datasets and fires only when a victim opens the dataset Settings page, the effective compensations follow those prerequisites: restrict dataset creation and editing to trusted, vetted users (this removes the injection capability entirely but blocks self-service dataset setup for untrusted tenants), and treat existing dataset names as untrusted content - review or rename dataset names containing HTML before other users browse the Settings page (renaming is manual and does not scale across large workspaces). Deployments that cannot limit dataset authoring should gate access to the annotation settings views to the same trusted group until a patched Argilla release is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Argilla is an open-source data-curation and annotation platform used to label and review data for LLM and NLP pipelines, with a Vue-based frontend (argilla-frontend) served alongside a Python backend. The flaw is CWE-79 (improper neutralization of input during web page generation) in the Settings Page component: the dataset Name argument is stored and later rendered by argilla-frontend/components/features/annotation/settings/SettingsInfo.vue without adequate encoding, so attacker-supplied markup is persisted and re-executed in other users' sessions. The VulDB-derived description attributes the sink to a 'Dataset.from_disk' function of that Vue file, which is a report-level artifact rather than a confirmed code path; the reliable element across sources is the Settings Page rendering of the dataset name. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P) scores confidentiality and availability impact as none and integrity impact as low, whereas the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) models scope change plus low confidentiality impact typical of script execution in a victim's session; both agree the attack is network-reachable, requires a low-privileged authenticated account, and requires victim interaction. The CPE string provided (cpe:2.3:a:n/a:argilla) is vendor-agnostic and cannot be used to distinguish builds; version scoping therefore comes from EUVD, which lists all releases from 2.0 through 2.8.0.
Know when Argilla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Authenticated low-priv user must set the dataset name (PR:L), a victim must view the settings page (UI:R), and stored script runs in the victim's browser context (S:C) with limited confidentiality/integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting in Argilla's annotation text field component (argilla-frontend/components/features/annotatio
Stored cross-site scripting in Argilla 2.0 through 2.8.0 allows a privileged, authenticated user to inject a crafted val
Exploit-DB