CVE-2026-116004

onyx-dot-app Onyx PreviewTab.tsx cross site scripting

View on CVE.org
Published Oct 25, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A cross‑site scripting vulnerability was identified in the PreviewTab component of onyx-dot-app Onyx. The flaw allows an attacker to inject arbitrary JavaScript by manipulating the data rendered by an unknown function in PreviewTab.tsx. Successful exploitation would enable a remote attacker to execute code within the victim’s browser context, potentially hijacking sessions, stealing cookies, or defacing the application.

Affected Systems

The issue is present in all releases of onyx-dot-app Onyx up to version 5.0.0. The affected component resides in web/src/app/craft/components/output-panel/PreviewTab.tsx and depends on the web interface of the application.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, and the vulnerability has been publicly disclosed but no exploits are recorded in KEV. Because the attack vector is remote and the flaw originates from unescaped user input, an attacker with web access to the application can trigger the script injection. The lack of vendor response underscores the need for immediate remediation before a public exploit emerges.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a version of onyx-dot-app that includes input sanitization for the PreviewTab component; if a patch is not yet available, modify PreviewTab.tsx to escape all user‑supplied content before rendering.
  • Disable or tightly restrict the function that feeds data into PreviewTab, ensuring that only trusted, validated content can reach the component.
  • Implement a Content Security Policy that blocks the execution of inline scripts and restricts script sources to trusted origins.
  • Monitor the application for anomalous script activity and consider rate‑limiting requests that target the PreviewTab URL to reduce the attack surface.

Generated by OpenCVE AI on October 25, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title onyx-dot-app Onyx PreviewTab.tsx cross site scripting
First Time appeared Onyx
Onyx onyx
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:onyx:onyx:*:*:*:*:*:*:*:*
Vendors & Products Onyx
Onyx onyx
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 6:31 PM
Reserved
Oct 24, 2026, 11:11 AM

View source JSON

Updated
Oct 29, 2026, 6:31 PM

JSON

Status
Deferred
Published
Oct 25, 2026, 3:16 AM
Modified
Oct 29, 2026, 7:17 PM

View source JSON

No data.

Updated
Oct 25, 2026, 9:00 AM

JSON