| Titolo | Argilla up to 2.8.0 Cross Site Scripting |
|---|
| Descrizione | A vulnerability was found in Argilla up to 2.8.0 and classified as medium 5.4.
Affected is the dataset Settings page of the web frontend (the component
argilla-frontend/components/features/annotation/settings/SettingsInfo.vue,
with the same sink in SettingsInfoReadOnly.vue). The manipulation of the
argument name leads to cross site scripting. It is possible to launch the
attack remotely. User interaction is required because a signed-in victim must
open the dataset Settings page. The dataset name is attacker-controlled
through the official Dataset.from_disk() disk-package import path and is
persisted server-side verbatim (the server only enforces a length of 1-200
characters), then rendered with v-html, so injected script executes in the
victim's session context. No patched release exists as of 2026-10-06
(2.8.0 is the latest release; the sink is still present on the develop branch).
Technical Details
- Affected file/function: argilla-frontend/components/features/annotation/settings/SettingsInfo.vue lines 8-11 (v-html="settings.dataset.name"); entry vector argilla/src/argilla/datasets/_io/_disk.py Dataset.from_disk()
- Vulnerable parameter: dataset name (.argilla/dataset.json "name" of an imported disk dataset package)
- Attack vector: Network
- Privileges required: Low (importer needs a workspace role allowed to import datasets; victim is any user opening the Settings page)
- Trigger condition: a crafted disk dataset package is imported via Dataset.from_disk(); every user who opens /dataset/<id>/settings executes the stored payload
Impact
- Confidentiality: Low (script can read page-visible data and act in the victim's session)
- Integrity: Low (UI actions possible within the victim's privileges)
- Availability: None
CVSS v3.1
Score: 5.4 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
|---|
| Fonte | ⚠️ https://github.com/argilla-io/argilla/issues/5875 |
|---|
| Utente | Dem00000 (UID 98563) |
|---|
| Sottomissione | 10/10/2026 10:01 (17 giorni fa) |
|---|
| Moderazione | 26/10/2026 15:44 (16 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 426455 [Argilla fino a 2.8.0 Settings Page SettingsInfo.vue Dataset.from_disk name cross site scripting] |
|---|
| Punti | 20 |
|---|