CVE-2026-82838
MediumCVSS 6.4Summary
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.
Risk Assessment
Lack of CSP may allow execution of malicious scripts in a user's browser, potentially leading to XSS attacks and data theft. This affects all deployments using the default image.
Recommendation
Update the Venueless Docker image to a version with CSP set. Also consider additional protections such as validation of uploaded SVG files.
Other vulnerabilities in Venueless
See all- CVE-2026-4982High
A user with 'update world' permission in any Venueless world can exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. Exploitation requires knowledge of the internal channel UUID.
- CVE-2026-5599High
A vulnerability in the venueless system allows a user with API access and 'manage users' permission in any world to trigger deletion of user accounts in other worlds.
Original NVD description (English source)
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.