| Titolo | Argilla up to 2.8.0 Cross Site Scripting |
|---|
| Descrizione | A vulnerability was found in Argilla up to 2.8.0 and classified as medium 5.4.
Affected is the TextField.vue component of the annotation frontend. The
manipulation of the argument text (dataset record field with use_markdown=false)
leads to cross site scripting. It is possible to launch the attack remotely.
User interaction is required because a victim must open the crafted record on
the annotation page.
Technical Details
- Affected file/function: argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue, final v-else branch (line 22 of the template)
- Vulnerable parameter: dataset record text field persisted via POST /api/v1/datasets/{dataset_id}/records/bulk
- Attack vector: Network
- Privileges required: Low (inserting records requires workspace admin/owner; the payload executes in the session of any annotator viewing the dataset)
- Trigger condition: the stored field value is neither Markdown nor paired HTML
(the component's isHTML regex only matches <tag>...</tag> pairs), so a
tag-borne payload such as <img src=x onerror=...> bypasses the Sandbox
renderer and is injected into the page DOM with the raw v-html directive on
/dataset/{id}/annotation-mode. Verified on release 2.8.0; the same code is
present on develop (commit 5338519accb13ae422f8bf9c0642651c249c49af) and main
as of 2026-10-06. A negative control with the inert data-onerror attribute
follows the identical render path but does not execute.
Impact
- Confidentiality: Low (script runs in the application origin and can reach
session/user data exposed to that origin)
- Integrity: Low (actions can be performed within the application origin on
behalf of the victim)
- Availability: None
CVSS v3.1
Score: 5.4 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
|---|
| Fonte | ⚠️ https://github.com/argilla-io/argilla/issues/5877 |
|---|
| Utente | Dem00000 (UID 98563) |
|---|
| Sottomissione | 10/10/2026 10:25 (17 giorni fa) |
|---|
| Moderazione | 26/10/2026 15:44 (16 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 426457 [Argilla fino a 2.8.0 TextField.vue text cross site scripting] |
|---|
| Punti | 20 |
|---|