CVE-2026-55650
Received Received - Intake

Stored XSS in Outerbase Studio Text Widget

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capable event handlers to execute when the widget is displayed. Outerbase Cloud and its backend services were discontinued in 2025, and the current architecture uses local browser dashboard storage, so the impact is limited to local self-XSS. Authentication token theft, account takeover, and backend database access are not applicable to the current architecture. No fixed release is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55650
EUVD
EUVD-2026-78591

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
outerbase studio to 0.10.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in Outerbase Studio's Text Widget. It allows unsanitized HTML to be rendered via dangerouslySetInnerHTML, enabling attackers to inject malicious scripts through crafted payloads like event handlers in HTML tags.

Detection Guidance

Check for Text Widgets in Outerbase Studio dashboards that contain unsanitized HTML or script event handlers. Look for payloads like <img src=x onerror="alert('XSS Executed\nToken: ' + localStorage.getItem('ob-token'))"> in widget content. Since the vulnerability is client-side only, inspect browser storage for suspicious entries.

Impact Analysis

The impact is limited to a local self-XSS due to the discontinued backend services. An attacker could execute scripts in the user's browser when viewing a crafted Text Widget, potentially stealing authentication tokens or other local data. However, token theft or account takeover is not possible in the current architecture.

Compliance Impact

This vulnerability has limited impact on compliance with standards like GDPR or HIPAA because Outerbase Cloud and backend services were discontinued in 2025. The current architecture relies on local browser storage, reducing exposure to data theft or unauthorized access. The XSS flaw only affects self-XSS in local dashboards, which does not involve external data handling or third-party systems typically regulated by these standards.

Mitigation Strategies

Upgrade to a version of Outerbase Studio that includes commit b06fb85 or later, which removes the unsafe HTML rendering. If upgrading is not possible, avoid using Text Widgets with HTML content or manually sanitize inputs before rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55650. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart