CVE-2026-116554: Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.fromdisk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access and interaction are required to exploit this issue?
The attacker needs low-level privileges and must be able to manipulate the Name argument used by Dataset.from_disk. A user must also interact with the crafted content for the cross-site scripting payload to execute.
Are installations affected by a public exploit?
Yes. An exploit has been published and may be used. The attack can be launched remotely.
Which versions are known to be affected?
Argilla versions up to and including 2.8.0 are identified as affected.
What is the vendor response status?
The project was notified early through an issue report, but no response has been reported.