GHSA-rjw9-xx87-f2ww: Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name

Published Nov 5, 2026

Updated

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the servicelabel helper that marks unescaped OAuth service display names as htmlsafe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

Event History

Nov 5, 2026

CVE Published

via OSV·03:11 PM

Data Sourced

via OSV·03:11 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Huginn instances running versions before 2026.11.05 are affected. Users who attach a globally shared OAuth account to Agents and then view those Agents can trigger the stored script; administrator users face additional risk because the script can perform admin actions in their session.

What does an attacker need to exploit it?

The attacker needs an authenticated Huginn account and the ability to connect an OAuth account whose nickname, name, or email contains crafted script content. They must then share that OAuth account globally and rely on another user attaching it to an Agent and viewing it.

Are Credentials, Agents, and Events directly exposed?

The vulnerability can execute JavaScript in the victim's browser when the affected display name is rendered. The described impact includes exposure of Credentials, Agents, and Events available through the victim's session.

How can I determine whether my deployment is affected?

Check whether the deployed Huginn version is earlier than 2026.11.05. Also review globally shared OAuth accounts for unusual or untrusted nickname, name, or email values, particularly accounts that may have been attached to Agents.

GHSA-rjw9-xx87-f2ww: Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are Credentials, Agents, and Events directly exposed?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are Credentials, Agents, and Events directly exposed?

How can I determine whether my deployment is affected?