2.4
LowCVSS 3.1 · from VulDB
CVE-2026-116555
Argilla Sandbox.vue cross site scripting
Argilla · Cross-site scripting · CWE-79AffectedArgilla
FixNo fix listed yet.
PublishedOct 26, 22:30 · VulDB
ScoredOct 26 · 2.4 · VulDB
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
From VulDB
Affected and fixed versions
ProductAffectedFixed inArgilla2.0–Argilla2.1–Argilla2.2–Argilla2.3–Argilla2.4–Argilla2.5–Argilla2.6–Argilla2.7–Argilla2.8.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known