CVE-2026-73038

Received Received - Intake

Stored XSS in NodeBB via ActivityPub Emoji Rendering

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73038

EUVD

EUVD-2026-58226

Affected Vendors & Products

Vendor	Product	Version / Range
nodebb	nodebb	to 4.15.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in NodeBB versions before 4.15.0. It occurs in the renderEmoji function, which fails to escape the tag.icon.url and tag.name attributes. Attackers can send malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored posts. When other users view these posts, the injected code executes in their browsers.

Detection Guidance

To detect this vulnerability, check if your NodeBB version is below 4.15.0. Inspect ActivityPub-related logs for malformed emoji tags or unusual HTML/JS injection attempts. Review posts containing emoji tags for suspicious payloads in tag.icon.url or tag.name fields.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code in the browsers of all users viewing the affected posts. This could lead to session theft, cross-site request forgery (CSRF), and account takeover for all viewers, including administrators. The attack is persistent as the malicious payload is stored in the database and served without proper sanitization.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating privacy regulations like GDPR and HIPAA. It may result in data breaches, unauthorized data access, or manipulation, which are non-compliant with these standards. Organizations using vulnerable NodeBB versions must address this issue to maintain compliance.

Mitigation Strategies

Upgrade NodeBB to version 4.15.0 or later. If upgrading is not immediately possible, apply the patch from commit c0d94a217edcafcdb9b3920a6e80935194bcb19e to validate emoji icon URLs using Helpers.isUri(). Disable ActivityPub federation temporarily if not required.

Hi! I’m here to help you understand CVE-2026-73038. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70