CVE-2026-73038

Name of the Vulnerable Software and Affected Versions NodeBB versions prior to 4.15.0

Description A stored cross-site scripting issue exists in the renderEmoji() function. The function fails to properly escape the tag.icon.url and tag.name attributes. This allows attackers to send malicious ActivityPub Create or Note objects containing crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, which then executes in the browsers of all users who view the content.

Recommendations Update to version 4.15.0 or later.