Argilla EUVD-2026-110503

Exploitation requires an authenticated account with privileges to submit or edit annotation text in Argilla (CVSS PR:H, though standard annotator access may suffice - verify against the permission model), and requires a second user to view the poisoned record for the stored payload to fire (UI:P). The specific prerequisite is the ability to write attacker-controlled text into the field rendered by argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue in Argilla versions 2.0 through 2.8.0. Limiting factors: the privilege gate (not unauthenticated), the need for victim interaction, impact confined to low integrity with no confidentiality or availability loss, and the absence of verified working exploit code. No configuration-specific toggle is named in the sources.

This is a low-priority issue despite being a genuine stored cross-site-scripting flaw (CWE-79) in Argilla's annotation TextField.vue component. All severity signals point low: the input CVSS 4.0 base score is 1.9, EPSS is 0.21% (11th percentile, i.e. low modeled exploitation probability), the vuln.today decision label is 'monitor', and the SSVC framework records Exploitation=poc, Automatable=no, Technical Impact=partial. The CVSS vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) shows a network-reachable but privilege-gated flaw: PR:H means the attacker needs high privileges to plant the payload, UI:P means a victim must view the affected field, and impact is limited to low integrity (VI:L) with no confidentiality or availability loss. The flaw is NOT in CISA KEV, so there is no confirmed active exploitation; exploitation status is best described as a public PoC reference exists that is not verified as working exploit code. The one caveat worth flagging: the input lists CVSS PR:H, yet a stored XSS in an annotation text field typically only requires a standard authenticated annotator account, which would be PR:L - the privilege prerequisite should be verified against Argilla's annotation permission model. Overall this is a high-CVSS-not-applicable case: a real but low-impact bug in a niche product with no vendor response yet, not an urgent remediation item.

An authenticated user with sufficient privileges to submit annotation text injects a malicious HTML/JavaScript payload into a record's text field; when another Argilla user (e.g. a reviewer or teammate) later opens that record, the stored script executes in their browser session. A public PoC reference exists (not verified as working exploit code), and because the CVSS vector is AV:N/AC:L the delivery itself is straightforward, though it depends on the attacker already holding an account and on a victim viewing the poisoned field.