CVE-2026-80426
Received Received - Intake

Stored XSS in FiftyOne Dataset Field Descriptions

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the neighbouring info values in the same component are rendered as React children and are escaped, so the description is the only raw path. A description is free-form text held in the dataset schema, so it persists in the database and travels with an exported or published dataset. Opening a dataset obtained from another party and hovering the field runs the stored markup in the application's origin. That origin is shared with the FiftyOne server, whose media route returns the contents of a caller-named absolute path and which is unauthenticated in the open-source server, so the injected script can read local files and reach the dataset and operator endpoints as the viewing user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-09-16
AI Q&A
2026-08-26
EPSS Evaluated
2026-09-14
NVD
CVE-2026-80426
EUVD
EUVD-2026-66600

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fiftyone fiftyone *
voxel51 fiftyone to 1.21.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in FiftyOne versions before 1.21.0. The issue occurs because field descriptions are passed directly to React's dangerouslySetInnerHTML without sanitization. Descriptions are free-form text stored in the dataset schema and persist in exported or published datasets. When a user opens a dataset from another party and hovers over a field, the stored markup executes within the application's origin. This allows an attacker to inject malicious scripts that can read local files and access dataset and operator endpoints as the viewing user.

Detection Guidance

This vulnerability is specific to the FiftyOne application and cannot be detected via standard network or system commands. It requires checking the version of FiftyOne installed on your system. If you are running a version before 1.21.0, your system is vulnerable.

Impact Analysis

If you use FiftyOne versions before 1.21.0, opening a dataset containing a malicious field description could allow an attacker to execute arbitrary scripts in your browser. This could lead to unauthorized access to local files, sensitive data exposure, or manipulation of dataset contents. The attack requires minimal user interaction, such as hovering over a field, and can affect users who open compromised datasets from untrusted sources.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive information, which may violate GDPR and HIPAA compliance. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A successful XSS attack could result in unauthorized access to such data, leading to legal penalties, reputational damage, and loss of trust. Organizations using unpatched versions of FiftyOne may face compliance violations if exploited.

Mitigation Strategies

Immediately upgrade FiftyOne to version 1.21.0 or later to patch the vulnerability. Avoid opening datasets from untrusted sources until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80426. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart