CVE-2026-72743: SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLBot SQText Dashboard Componentto a version that resolves this vulnerability.Fixed in 1.10.0Patch c3f40a5 - Configuration
Fix stored XSS by removing/avoiding raw TinyMCE output rendered via v-html without sanitization in the SQText dashboard component.
SQText dashboard component (TinyMCE rendering) v-html sanitization = sanitized output (no raw v-html rendering without sanitization)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72743?
The severity of CVE-2026-72743 is classified as medium, with a CVSS score of 5.4.
How do I fix CVE-2026-72743?
To fix CVE-2026-72743, upgrade SQLBot to version 1.10.1 or later, which contains the necessary security patch.
What type of vulnerability is CVE-2026-72743?
CVE-2026-72743 is a stored cross-site scripting (XSS) vulnerability in the SQText dashboard component.
Who is at risk with CVE-2026-72743?
Users who can modify the dashboard text widget content in SQLBot are at risk of CVE-2026-72743.
What component of SQLBot is affected by CVE-2026-72743?
The SQText dashboard component of SQLBot is affected by CVE-2026-72743 due to a lack of output sanitization.