CVE-2026-123094

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-123094
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123094.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-123094
Aliases
  • GHSA-rjw9-xx87-f2ww
Published
2026-11-05T15:11:49Z
Modified
2026-11-05T21:32:23Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name
Details

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123094.json"
}
References

Affected packages

Git / github.com/huginn/huginn

Affected ranges

Type
GIT
Repo
https://github.com/huginn/huginn
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cdb9f9295d792f7a512a4e2f79a82ae0571c8aa9
Fixed
92229a5e7343bfffc740d31e42b9654b212b678b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2026.11.05"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "92229a5e7343bfffc740d31e42b9654b212b678b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2026.11.05",
            "range": [
                {
                    "fixed": "cdb9f9295d792f7a512a4e2f79a82ae0571c8aa9"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2022.*
v2022.01.04
v2022.08.18
v2026.*
v2026.08.27
v2026.09.08
v2026.09.09
v2026.09.21
v2026.09.22
v2026.10.04
v2026.10.14
v2026.10.24
v2026.10.26
v2026.11.01

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123094.json"