A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Argilla
  • Argilla

No data.

No data.

References
Link Providers
https://github.com/3em0/cve_repo/tree/main/2026/argilla-io.argilla_stored_xss_custom_field_iframe/poc cve-icon cve-icon
https://github.com/argilla-io/argilla/issues/5876 cve-icon cve-icon
https://vuldb.com/cve/CVE-2026-116555 cve-icon cve-icon
https://vuldb.com/submit/1022936 cve-icon cve-icon
https://vuldb.com/vuln/426456 cve-icon cve-icon
https://vuldb.com/vuln/426456/cti cve-icon cve-icon
History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title Argilla Sandbox.vue cross site scripting
First Time appeared Argilla
Argilla argilla
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:argilla:argilla:*:*:*:*:*:*:*:*
Vendors & Products Argilla
Argilla argilla
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-26T22:30:16.499Z

Updated: 2026-10-26T22:30:16.499Z

Reserved: 2026-10-26T14:44:38.748Z

Link: CVE-2026-116555

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-26T23:16:59.497

Modified: 2026-10-27T14:52:13.410

Link: CVE-2026-116555

cve-icon Redhat

No data.