CVE-2024-57041

MediumCVSS 4.6

Published: 24/01/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

30.49%

98th percentile - higher than 98% of all known CVEs

Summary

A persistent cross-site scripting (XSS) vulnerability was found in NodeBB v3.11.0. An attacker can store arbitrary JavaScript code in the 'About Me' section of their profile.

Risk Assessment

The risk involves executing malicious scripts in browsers of other users visiting the attacker's profile, potentially leading to session theft, account takeover, or data leakage.

Recommendation

Immediately update NodeBB to the latest available version that includes a fix for this vulnerability. Additionally, implement input filtering and output encoding for profile fields.

Original NVD description (English source)

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.