EUVD-2026-16898
GHSA-gj7h-pv73-9jrx
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v4.0 vector (AV:N/AC:L/PR:N/UI:P) indicates network attack vector with low complexity and no privilege requirements, but requires user interaction (UI:P) - a critical limiting factor. CVSS base score of 5.3 reflects moderate severity with limited integrity impact. The presence of publicly available exploit code (POC) increases practical risk, but the requirement for user interaction significantly reduces automated exploitation likelihood. EPSS metric (E:P) suggests proof-of-concept/low real-world exploitation probability. While this is classified as moderate severity, the combination of user interaction requirement, no authentication bypass, and lack of confidentiality or system availability impact suggests this is lower priority than the base CVSS suggests - typical stored/reflected XSS with limited scope. The vendor's non-response is concerning for long-term security posture but does not change the technical risk profile. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL containing HTML injection payload in the ID parameter of the create_share or get_share endpoint (e.g., ?id=<img src=x onerror=alert('XSS')>) and sends it to a user via phishing email or social engineering. When the user clicks the link and the backend renders the response without encoding, the injected JavaScript executes in the user's browser, potentially stealing session cookies or performing actions on behalf of the user. A proof-of-concept demonstrating this attack is publicly available on GitHub, reducing the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
HTML injection in wandb OpenUI up to version 1.0 allows remote unauthenticated attackers to inject arbitrary HTML via manipulation of the ID argument in the create_share and get_share functions in backend/openui/server.py. The attack requires user interaction and has a publicly available exploit. CVSS score is 5.3 (moderate) with EPSS indicating limited practical exploitation probability. The vendor has not responded to disclosure attempts.
RemediationAI
Update wandb OpenUI to a version beyond 1.0 that implements proper HTML entity encoding or uses a templating engine with automatic XSS protection for user-supplied input in the ID parameter. Implement input validation to reject or sanitize ID parameters that contain HTML special characters. As an interim workaround, restrict network access to the backend/openui/server.py endpoints or implement Web Application Firewall (WAF) rules to block requests with HTML metacharacters in the ID parameter. No specific patched version number is available from vendor advisory; users should monitor the wandb project on GitHub (https://github.com/wandb/openui) for release notes indicating XSS fixes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the HTMLAnnotator component's share functionality within wandb OpenUI, specifically in the create_share and get_share functions. CWE-79 (Cross-site Scripting/XSS) indicates that user-supplied input via the ID parameter is not properly sanitized or encoded before being rendered as HTML content. The network-accessible backend endpoint processes the ID argument without validation, allowing an attacker to inject malicious HTML tags and scripts. This is a classic input validation failure where the application fails to implement proper output encoding for HTML contexts.
Know when Wandb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in wandb OpenUI up to 1.0. This affects the function create_share/get_share of the file backend/openui/server.py of the component HTMLAnnotator Component. Executing a manipulation of the argument ID can lead to HTML injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using wandb OpenUI should be aware of moderate risk from CVE-2026-4992, a cross-site scripting vulnerability rated CVSS 5.3. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Path traversal in the Weights & Biases (wandb) Python client before 0.29.0 lets a malicious or compromised W&B backend p
Stored cross-site scripting (XSS) in wandb OpenUI up to version 1.0 via the Window Message Event Handler in frontend/pub
Information disclosure in wandb OpenUI up to version 1.0/3.5-turb allows authenticated local network attackers to expose
Wandb OpenUI up to version 1.0 contains hard-coded credentials exposure in backend/openui/config.py where the LITELLM_MA
Artifact Integrity Validation in wandb 0.25.2.dev1 uses MD5 (a cryptographically broken hash algorithm) within ArtifactM
Exploit-DB