EUVD-2026-110502
GHSA-xp46-h5hf-pxx8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with privileged config access
-
DeliveryInject script into custom-field template
-
ExploitVictim opens annotation sandbox field
-
ExecutionScript executes in victim browser
-
ImpactAlter rendered content or hijack session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a privileged, authenticated Argilla account able to set the 'template' argument of a custom field handled by argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue (PR:H), and a second user must subsequently view that annotation field for the stored payload to execute (UI:P / passive interaction). This affects Argilla versions 2.0 through 2.8.0. The high-privilege prerequisite and the dependency on a victim opening the crafted field are the primary limiting factors; impact is confined to limited integrity within the victim's browser context, with no confidentiality or availability impact per the assessed vector. |
| Impact | This is a low-priority, low-risk issue despite being a remotely reachable XSS, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) shows network reachability but requires high privileges (PR:H) and victim interaction (UI:P), with only limited integrity impact (VI:L) and no confidentiality or availability impact, yielding a base score of 1.9. EPSS reinforces this: 0.21% probability at the 11th percentile indicates very low expected exploitation. The vuln.today decision label is 'monitor', the CVE is NOT in CISA KEV, and the referenced PoC is a reference only, not verified as working exploit code. The PR:H requirement is the key limiter - an attacker already needs a privileged account that can set the custom-field template, which substantially narrows real-world risk to insider/post-authentication abuse rather than mass exploitation. No signals conflict here; all point to a genuine but minor stored-XSS issue, not a high-urgency flaw. |
| Exploit ScenarioDerived | An authenticated user with privileges to configure a custom field template injects a malicious script into the 'template' argument rendered by Sandbox.vue; when another Argilla user (e.g. an annotator or reviewer) opens the affected field, the script executes in their browser session. A public PoC reference exists (a stored XSS via a custom-field iframe) but it is not verified as working exploit code, and the limited integrity-only impact plus the high-privilege prerequisite make opportunistic exploitation unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Stored cross-site scripting in Argilla 2.0 through 2.8.0 allows a privileged, authenticated user to inject a crafted value into the 'template' argument of a custom annotation field, which is rendered by argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue and executes in the browser of a second user who later views that field. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) confines the outcome to limited integrity impact in the victim's browser session, with no confidentiality or availability impact, and the high-privilege prerequisite plus the need for a victim to open the crafted annotation are the main limiting factors. This is a low-priority, low-risk issue: EPSS is 0.21% (11th percentile), there is no CISA KEV entry, the priority decision is 'monitor', and a public PoC reference exists but is not verified as working exploit code. No vendor fix has been identified; the project was notified via issue #5876 and has not responded.
RemediationAI
No vendor-released patch was identified at the time of analysis: the issue was filed upstream at https://github.com/argilla-io/argilla/issues/5876 and the project has not responded, so no fixed Argilla version can be cited and the VulDB advisory at https://vuldb.com/vuln/426456 should be monitored for a resolution. Until a fix ships, the most direct compensating control is to restrict who can create or edit datasets and custom field definitions so that only fully trusted administrators can set template content, since the vulnerable write path requires a privileged account; the trade-off is loss of delegation for dataset curators. A second option is to remove or replace any custom field templates in existing Argilla datasets that contain HTML or scripting constructs, and to avoid the Sandbox-rendered custom-field type entirely on shared or multi-tenant instances, accepting the loss of that customization feature. A Content-Security-Policy on the Argilla frontend that blocks inline and third-party script execution will reduce the impact of an already-stored payload, but may break legitimately script-dependent custom templates where those are still in use. Reviewing annotation definitions for template values introduced by less-trusted users gives detection coverage for payloads that are already persisted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Argilla is a collaboration platform for building and curating NLP/LLM datasets; its annotation UI is a Vue-based frontend in which 'custom fields' let dataset administrators supply their own template markup that the frontend renders inside a sandbox component (Sandbox.vue) on the annotation screen. The flaw is CWE-79 (cross-site scripting), rooted in the failure to neutralize user-supplied content before it is placed into the rendered annotation field, so a template value persists with the dataset/field configuration rather than being reflected once. Because the payload is stored and only fires when another user loads that annotation, exploitation requires two distinct parties: someone with enough privilege to define or edit the custom field template (PR:H in both the CVSS 4.0 and assessed 3.1 vectors) and a victim who subsequently views the field (UI:P in CVSS 4.0, UI:R in the 3.1 assessment). The assessed vector marks scope as changed (S:C) and impact as C:L/I:L/A:N, meaning script execution is contained to the victim's browser context and yields limited integrity effect rather than server-side compromise; CVSS 4.0 scored it 1.9 with VC:N/VI:L. The underlying library-level mechanism and the precise sanitization gap in Sandbox.vue are not described in the available sources; the trigger is understood to be rendering of the attacker-controlled template value, but the sources do not detail the exact escaping or directive involved.
Know when Argilla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Stored XSS requires a privileged account to set the field template (PR:H) and a victim to view it (UI:R); script runs in the victim's browser authority (S:C) with limited C/I impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting in Argilla 2.0 through 2.8.0 allows a user who can create or edit a dataset to inject script
Stored cross-site scripting in Argilla's annotation text field component (argilla-frontend/components/features/annotatio
Exploit-DB