The vulnerability originates in Argilla’s front‑end SettingsInfo.vue component within the Dataset.from_disk function. By manipulating the Name argument, an attacker can inject arbitrary script code that is executed in the context of any authenticated user. This enables session hijacking, defacement or other client‑side attacks. The flaw maps to the common weaknesses identified as CWE‑79 and CWE‑94.

Argilla releases up to and including version 2.8.0 are affected. The vulnerability resides in the Argilla annotation settings module and affects all deployments of the platform that have not yet upgraded beyond 2.8.0.

The CVSS score of 5.1 indicates a moderate level of risk for confidentiality and integrity. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, yet an exploit has been published and the issue has been reported to the project without a response. Attackers can remotely trigger the XSS by loading a dataset with a crafted Name field, and the impact is confined to the client’s browser but can compromise credentials or data for the victim session.