TI-2026-29034 Aliases CVE-2026-40229 GHSA-qxjc-9q88-9cgh

Helpy 2.8.0 - Stored XSS in post author display via PostsHelper

LOW 22CWE-79Published 2026-04-29 · Updated 2026-04-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML notification emails sent to other users.This issue affects helpy: 2.8.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00177 7th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
helpyio	helpy	2.8.0	—	No fix listed	CNA

helpy Vendorhelpyio Affected 2.8.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:helpy.io:helpy:2.8.0:::::::*	2.8.0	Vulnerable	helpyio

cpe:2.3:a:helpy.io:helpy:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·helpyio

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-40229
2026-10-03 Alias added: GHSA-qxjc-9q88-9cgh

References

Exploit 1

https://fluidattacks.com/es/advisories/offspring

Other 1

https://github.com/helpyio/helpy

TI-2025-32500 Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to… CVSS 3.1MEDIUM 6.1
TI-2023-00341 Cross-site scripting in Helpy CVSS 3.1MEDIUM 6.1
TI-2018-14813 Helpy before 2.2.0 allows agents to edit admins. CVSS 3.0HIGH 8.8
TI-2018-13383 Helpy v2.1.0 has Stored XSS via the Ticket title. CVSS 3.1MEDIUM 6.1
TI-2026-29035 Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences