PT-2026-122935

CVE-2026-116004

·

Published

2026-10-25

·

Updated

2026-10-25

Description by

CVSS 2.0
4.0
Medium
MetricsAV:N/AC:L/Au:S/C:N/I:P/A:N
A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
CWE-94: Improper Control of Generation of Code (\'Code Injection\')
Related identifiers
CVE-2026-116004
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com