Voxel51 FiftyOne up to 1.20.x Sidebar Field-Information index.tsx dangerouslySetInnerHTML cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in Voxel51 FiftyOne up to 1.20.x. Affected by this vulnerability is the function dangerouslySetInnerHTML of the file app/packages/core/src/components/FieldLabelAndInfo/index.tsx of the component Sidebar Field-Information Component. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-80426. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Voxel51 FiftyOne up to 1.20.x. It has been declared as problematic. This vulnerability affects the function dangerouslySetInnerHTML of the file app/packages/core/src/components/FieldLabelAndInfo/index.tsx of the component Sidebar Field-Information Component. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the neighbouring info values in the same component are rendered as React children and are escaped, so the description is the only raw path. A description is free-form text held in the dataset schema, so it persists in the database and travels with an exported or published dataset. Opening a dataset obtained from another party and hovering the field runs the stored markup in the application's origin. That origin is shared with the FiftyOne server, whose media route returns the contents of a caller-named absolute path and which is unauthenticated in the open-source server, so the injected script can read local files and reach the dataset and operator endpoints as the viewing user.

The advisory is available at github.com. This vulnerability was named CVE-2026-80426 since 08/26/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

Upgrading to version 1.21.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Voxel51

Name

• FiftyOne

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion