CVE-2026-116555: Argilla Sandbox.vue cross site scripting
A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access and interaction are required for exploitation?
The attack can be carried out remotely, but the attacker must have high privileges and user interaction is required. The vulnerable input is the template argument handled by Sandbox.vue.
Which deployments are known to be affected?
Argilla versions up to and including 2.8.0 are reported as affected. The available information does not identify a fixed version or a configuration-specific limitation.
Is public exploit information available, and is a vendor fix known?
An exploit has been publicly disclosed and may be used. The project was notified through an issue report but had not responded at the time of the report, and no patch is identified in the provided information.