CVE-2026-116004: Onyx: stored XSS in craft PreviewTab output panel

LOW

Published October 25, 2026

CISO Take

Onyx (an open-source enterprise AI assistant and search platform) up to version 5.0.0 contains a cross-site scripting flaw in the Craft output preview panel (PreviewTab.tsx), letting a low-privileged authenticated user get script to run in another user's browser session. Severity is low (CVSS 3.5), requires user interaction, and affects only integrity, with no KEV listing, no EPSS data, no Nuclei template and no confirmed public exploit tooling. The vendor has not responded to the researcher, and the GitHub advisory link is broken, so no patched version is confirmed. Treat this as a low-priority item: restrict Craft access to trusted users, verify the exposure of your Onyx deployment, and enforce a strict Content-Security-Policy while tracking the upstream repository for a fix.

Sources:NVDVulDBATLASGitHub Advisory

What is the risk?

Low overall risk. CVSS 3.5 reflects network reachability and low attack complexity, but it requires a valid low-privileged account and victim interaction, and impact is limited to low integrity. The vector marks exploit code maturity as proof-of-concept, and the description says the exploit has been disclosed publicly, yet no weaponized exploit, scanner template, or KEV entry exists. The lack of vendor response raises residual risk because no fix timeline exists. The CWE-94 tag (code injection) alongside CWE-79 suggests that rendered previews may execute generated or user-supplied markup, which could make impact higher in deployments where the preview renders AI-generated content. Exposure is highest where Onyx is shared across many users or where admin sessions view previews.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privileged account on an Onyx instance and crafts content with a script payload.

AML.T0049

Delivery

Victim user opens the Craft output preview, which renders the payload without sanitization.

AML.T0011.003

Exploitation

Injected script executes in the victim's browser within the Onyx origin.

Impact

Attacker performs actions with the victim's session or alters displayed content, causing limited integrity impact.

Initial Access

Attacker authenticates with a low-privileged account on an Onyx instance and crafts content with a script payload.

AML.T0049

Delivery

Victim user opens the Craft output preview, which renders the payload without sanitization.

AML.T0011.003

Exploitation

Injected script executes in the victim's browser within the Onyx origin.

Impact

Attacker performs actions with the victim's session or alters displayed content, causing limited integrity impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Onyx	—	—	No patch

Do you use Onyx? You're affected.

How severe is it?

CVSS 3.1

3.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SUnchanged

CNone

ILow

ANone

What should I do?

1 step

1) Check for a fixed release in the onyx-dot-app/onyx repository and upgrade beyond 5.0.0 when available; no patched version is confirmed today. 2) Restrict or disable the Craft preview feature for untrusted users until fixed. 3) Apply a strict Content-Security-Policy (no inline scripts, restricted script-src) and an isolated sandboxed iframe for previews at the reverse proxy. 4) Limit account creation and review who holds authenticated accounts. 5) Monitor web logs for unusual payloads (script tags, event handlers) in Craft-related requests, and review the VulDB entry for updates. 6) Treat admin sessions with caution: avoid opening shared previews while logged in as an administrator.

How is it classified?

Code ExecutionData LeakageFrameworkAPIAML.T0011.003- Malicious Link AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-116004?

Is CVE-2026-116004 actively exploited?

No confirmed active exploitation of CVE-2026-116004 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-116004?

1) Check for a fixed release in the onyx-dot-app/onyx repository and upgrade beyond 5.0.0 when available; no patched version is confirmed today. 2) Restrict or disable the Craft preview feature for untrusted users until fixed. 3) Apply a strict Content-Security-Policy (no inline scripts, restricted script-src) and an isolated sandboxed iframe for previews at the reverse proxy. 4) Limit account creation and review who holds authenticated accounts. 5) Monitor web logs for unusual payloads (script tags, event handlers) in Craft-related requests, and review the VulDB entry for updates. 6) Treat admin sessions with caution: avoid opening shared previews while logged in as an administrator.

What systems are affected by CVE-2026-116004?

This vulnerability affects the following AI/ML architecture patterns: Enterprise AI assistants, RAG-based search platforms, AI web front ends and chat UIs.

What is the CVSS score for CVE-2026-116004?

CVE-2026-116004 has a CVSS v3.1 base score of 3.5 (LOW). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

Enterprise AI assistantsRAG-based search platformsAI web front ends and chat UIs

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploitation Scenario

An attacker with a low-privileged account on a shared Onyx instance creates or shares Craft content containing a crafted script payload. When a colleague or administrator opens the output preview, the payload runs in their browser under the Onyx origin. The script can issue authenticated API calls to alter settings or content, or to redirect the user to a phishing page, leveraging the victim's access to the organization's indexed knowledge.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.