high · CVSS v3 5.4 · CVSS v4 8.3
CVE-2026-117493
Stored XSS in BloX widgets allows malicious code to run in browsers rendering the widget, potentially leaking confidential data.
Overview
Stored XSS in BloX widgets allows malicious code to run in browsers rendering the widget, potentially leaking confidential data.
Description
Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/ /widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.
Impact
The vulnerability enables attackers to inject and execute scripts in the context of any user viewing the widget, exposing session cookies, reading sensitive data, and performing actions on behalf of the user. It primarily impacts end‑users and administrators who interact with the affected dashboards.
Remediation
Apply the vendor’s patch that sanitizes the ‘desc’ and ‘text’ fields, enforce a strict Content‑Security‑Policy that blocks inline scripts, escape all HTML output, and consider disabling script execution in widgets until patched. Monitor dashboard logs for suspicious content and restrict widget creation to trusted users.
Risk context
High severity (CVSS v4 8.3) indicates a significant risk of data compromise; patching should be prioritized promptly.
Affected products
- BloX Widgets
- BloX Dashboard API
Scores
- Severity
- high
- CVSS v2
- 3.5
- CVSS v3
- 5.4
- CVSS v4
- 8.3
- EPSS
- —