CVE-2026-116555
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in Sandbox.vue via manipulation of the template argument. Remote exploitation is possible and a public exploit is available.
Risk Assessment
A remote attacker could execute malicious script in a user's browser, potentially leading to session or data theft.
Recommendation
Implement input validation and encoding in the Sandbox.vue component and consider restricting access to the application until a fix is released.
Other vulnerabilities in Argilla
See all- CVE-2026-116556Low
A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in TextField.vue via manipulation of the text argument. The attack can be executed remotely and a public exploit is available.
- CVE-2026-116554Low
A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in SettingsInfo.vue (Settings Page) via manipulation of the Name argument. The attack can be launched remotely and a public exploit is available.
Original NVD description (English source)
A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS