CVE-2026-116556: Argilla TextField.vue cross site scripting
A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The manipulation of the argument text results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The attack can be executed remotely, but it requires high privileges and user interaction. An attacker must be able to manipulate the relevant text argument so that the crafted content is processed by the affected frontend component.
How urgent is remediation?
The reported severity is low, with an impact limited to integrity and no reported confidentiality or availability impact. However, public exploit information is available, which can make exploitation more practical where the required privileges and user interaction are present.
Is a vendor fix available?
The issue affects Argilla versions up to 2.8.0, and the available information does not identify a fixed version. The project was reportedly notified through an issue report but had not responded at the time of publication.