CVE-2026-116554

3.5 LOWpublic exploit available

Published 2026-10-26 · Updated 2026-10-26

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses

CWE-79, CWE-94

Public exploit & PoC references

https://github.com/3em0/cve_repo/tree/main/2026/argilla.argilla_stored_xss_dataset_name/poc
https://github.com/argilla-io/argilla/issues/5875

All references

https://github.com/3em0/cve_repo/tree/main/2026/argilla.argilla_stored_xss_dataset_name/poc
https://github.com/argilla-io/argilla/issues/5875
https://vuldb.com/cve/CVE-2026-116554
https://vuldb.com/submit/1022934
https://vuldb.com/vuln/426455
https://vuldb.com/vuln/426455/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100174PoC
LOWCVE-2026-100311PoC
MEDIUMCVE-2026-100313PoC
MEDIUMCVE-2026-100877PoC
LOWCVE-2026-100880PoC
LOWCVE-2026-100881PoC
LOWCVE-2026-100882PoC
LOWCVE-2026-100904

Related by shared AI tags and CWE weakness class. Browse the full archive.