CVE-2026-116554
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in SettingsInfo.vue (Settings Page) via manipulation of the Name argument. The attack can be launched remotely and a public exploit is available.
Risk Assessment
A remote attacker could execute malicious script in a user's browser, potentially leading to session or data theft.
Recommendation
Implement input validation and encoding in the SettingsInfo.vue component and consider restricting access to the application until a fix is released.
Other vulnerabilities in Argilla
See all- CVE-2026-116556Low
A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in TextField.vue via manipulation of the text argument. The attack can be executed remotely and a public exploit is available.
- CVE-2026-116555Low
A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in Sandbox.vue via manipulation of the template argument. Remote exploitation is possible and a public exploit is available.
Original NVD description (English source)
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS