CVE-2026-116004
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
CVSS v3.1 (listed by NVD)
3.5
LOW
Scored by vuldb.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0 (listed by NVD)
2.0
LOW
Scored by vuldb.com (not yet scored by NVD)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
5.1
MEDIUM
Scored by CNA (VulDB) · v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkLoginUser action
PoC
Confidentiality NIntegrity LAvailability N
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | L | Regular user |
| User interaction UI | R | Required |
| Scope S | U | Unchanged |
| Confidentiality C | N | None |
| Integrity I | L | Low |
| Availability A | N | None |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Description
NVD
A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 4.0 | 2.0 LOW | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD / [email protected] (Primary) | 3.1 | 3.5 LOW | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| NVD / [email protected] (Secondary) | 2.0 | 4.0 MEDIUM | AV:N/AC:L/Au:S/C:N/I:P/A:N |
| CNA / VulDB | 4.0 | 5.1 MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA / VulDB | 3.1 | 3.5 LOW | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C |
| CNA / VulDB | 3.0 | 3.5 LOW | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C |
| CNA / VulDB | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| onyx-dot-app | Onyx | affected: 5.0 |
Linux distribution status
References (6)
- https://github.com/onyx-dot-app/onyx/ NVD, CNA product
- https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-grhq-88h5-2h86 NVD, CNA broken-link
- https://vuldb.com/cve/CVE-2026-116004 NVD, CNA third-party-advisory
- https://vuldb.com/submit/992835 NVD, CNA third-party-advisory
- https://vuldb.com/vuln/426102 NVD, CNA vdb-entry
- https://vuldb.com/vuln/426102/cti NVD, CNA signaturepermissions-required