CVE-2026-4992

Name of the Vulnerable Software and Affected Versions wandb OpenUI versions up to 1.0

Description A flaw exists in wandb OpenUI, specifically within the HTMLAnnotator component. The issue resides in the create share/get share function located in the backend/openui/server.py file. Manipulation of the ID argument can lead to HTML injection, potentially allowing for remote attacks.

Recommendations Versions prior to 1.0 should be updated. As a temporary workaround, consider restricting access to the create share/get share function until a patch is available.