CVE-2026-73038 in NodeBB
Summary
by MITRE • 08/13/2026
NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability under examination affects NodeBB versions prior to 4.15.0 and represents a critical stored cross-site scripting flaw within the renderEmoji function. This security weakness stems from insufficient input validation and output encoding of user-supplied data, specifically targeting the tag.icon.url and tag.name attributes that are processed during emoji rendering operations. The issue manifests when NodeBB processes ActivityPub Create/Note objects containing maliciously crafted emoji tags, allowing attackers to inject arbitrary HTML and JavaScript code into stored content that gets rendered for all users who view the affected posts.
The technical implementation of this vulnerability involves the improper handling of emoji metadata within the ActivityPub protocol integration. When NodeBB receives a Create/Note object containing emoji tags with malicious payloads in their url and name fields, the renderEmoji function fails to properly sanitize or escape these attributes before incorporating them into the HTML output. This failure creates an environment where attacker-controlled data can be executed as client-side code within the browser context of legitimate users. The vulnerability is classified as a stored XSS because the malicious content persists in the server's database and affects all future viewers without requiring additional interaction from the victim.
From an operational perspective, this vulnerability poses significant risks to NodeBB communities that rely on ActivityPub for federated communication. Attackers can exploit this flaw by crafting malicious emoji tags within ActivityPub notes, which when processed by vulnerable NodeBB instances, will execute code in the browsers of all users who encounter the affected content. The impact extends beyond simple script execution to potentially enable session hijacking, data exfiltration, and full browser compromise. The vulnerability affects all users who view posts containing the malicious emoji tags, making it particularly dangerous for widely accessible forums and communities that frequently exchange ActivityPub content.
The security implications of this flaw align with CWE-79 which addresses cross-site scripting vulnerabilities through inadequate input sanitization or output encoding. Additionally, this vulnerability maps to ATT&CK technique T1566.002 which covers the exploitation of web applications through maliciously crafted payloads delivered via federated protocols. The attack vector leverages ActivityPub's federated nature to deliver malicious content to vulnerable systems without requiring direct user interaction beyond viewing the compromised posts. Organizations should immediately implement mitigations including upgrading to NodeBB version 4.15.0 or later, implementing strict input validation for emoji data, and deploying content security policies that limit script execution within forum contexts. Network-level protections such as web application firewalls can provide additional defense-in-depth, though the primary mitigation remains the application of the vendor-provided security patch to address the root cause of the vulnerability.
The broader implications extend to federated social platforms where similar vulnerabilities may exist in other implementations. This flaw demonstrates how integrating federated protocols without proper sanitization of received content can create persistent security risks across interconnected systems, emphasizing the importance of robust input validation and output encoding practices in distributed web applications.