CVE-2026-97868
Deferred Deferred - Pending Action

Cross-Site Scripting in Zen Up Note Editor

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulDB

Description
A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-16
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97868
EUVD
EUVD-2026-87113

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sheshbabu zen to 1.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in the sheshbabu zen application up to version 1.5.0. The issue is in the NotesEditor.jsx file where the dangerouslySetInnerHTML function is used. An attacker can remotely inject malicious scripts into the application through this function.

Detection Guidance

This vulnerability is specific to the sheshbabu zen application up to version 1.5.0 and involves a cross-site scripting issue in the NotesEditor.jsx component. To detect it, inspect the application for usage of the dangerouslySetInnerHTML function in the Note Editor component. Check if the application is running version 1.5.0 or earlier.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in the context of the application, potentially stealing user data, session tokens, or performing actions on behalf of users. It may lead to unauthorized access or data breaches.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may risk protected health information exposure, leading to compliance failures and penalties.

Mitigation Strategies

Immediately update sheshbabu zen to a version that is not affected by this issue. If no update is available, disable or remove the NotesEditor.jsx component if it is not essential. Implement input validation and output encoding to prevent XSS attacks in the application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97868. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart