CVE-2026-116556
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in TextField.vue via manipulation of the text argument. The attack can be executed remotely and a public exploit is available.
Risk Assessment
A remote attacker could execute malicious script in a user's browser, potentially leading to session or data theft.
Recommendation
Implement input validation and encoding in the TextField.vue component and consider restricting access to the application until a fix is released.
Other vulnerabilities in Argilla
See all- CVE-2026-116555Low
A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in Sandbox.vue via manipulation of the template argument. Remote exploitation is possible and a public exploit is available.
- CVE-2026-116554Low
A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in SettingsInfo.vue (Settings Page) via manipulation of the Name argument. The attack can be launched remotely and a public exploit is available.
Original NVD description (English source)
A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The manipulation of the argument text results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS