CVE-2026-116004
Deferred Deferred - Pending Action

XSS in Onyx up to 5.0.0

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulDB

Description
A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116004
EUVD
EUVD-2026-109330

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
onyx-dot-app Onyx 5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in the Onyx application up to version 5.0.0. It exists in the PreviewTab.tsx file of the web application. An attacker can remotely inject malicious scripts into web pages viewed by other users, potentially stealing data or performing unauthorized actions.

Detection Guidance

Detecting this XSS vulnerability requires checking for affected Onyx versions (up to 5.0.0) and inspecting the PreviewTab.tsx file in the web/src/app/craft/components/output-panel/ directory for malicious input handling. Use commands like 'find / -name PreviewTab.tsx 2>/dev/null' to locate the file and review its content for improper sanitization or unsafe rendering of user inputs.

Impact Analysis

If you use Onyx up to version 5.0.0, an attacker could exploit this XSS flaw to run malicious scripts in your browser when accessing certain pages. This may lead to theft of session cookies, login credentials, or other sensitive data. It could also allow unauthorized actions on your behalf within the application.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information, risking compliance with safeguards for electronic protected health information.

Mitigation Strategies

Immediately upgrade Onyx to a version beyond 5.0.0 if available. If no patch exists, disable the PreviewTab.tsx component or restrict access to it. Implement input validation and output encoding for all user-controlled data. Monitor network traffic for signs of exploitation attempts targeting this XSS vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart