Read the docs
TI-2024-37765 Aliases CVE-2024-57041GHSA-vqr3-vrrg-f3jh

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote…

Priority MEDIUM 54CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.40107 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nodebb (npm): 3.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—nodebb (npm)before 3.11.13.11.1Patch availableGHSA-vqr3-vrrg-f3jh
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • nodebb (npm) Vendor— Affected before 3.11.1 Fixed in 3.11.1 Patch available GHSA-vqr3-vrrg-f3jh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodebb:nodebb:3.11.0:*:*:*:*:*:*:*3.11.0VulnerableNodeBB
  • cpe:2.3:a:nodebb:nodebb:3.11.0:*:*:*:*:*:*:* Versions 3.11.0 Vulnerable ·NodeBB

Remediation

  • Fix · GHSA-vqr3-vrrg-f3jh nodebb (npm) Fixed in 3.11.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-57041
  2. 2026-10-03 Alias added: GHSA-vqr3-vrrg-f3jh

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2023-23124 A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc… CVSS 3.1CRITICAL 9.8
  • TI-2022-22808 Account takeover via prototype vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-42173 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User CVSS 4.0HIGH 8.7
  • TI-2025-32286 NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint… CVSS 3.1HIGH 8.6
  • TI-2023-14416 NodeBB Pre-Authentication Denial-of-Service CVSS 3.1HIGH 7.5
  • TI-2022-16499 Account takeover via SSO plugins in NodeBB CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences