TI-2026-51247 Aliases CVE-2026-73038 GHSA-fh4m-97qj-ff6c

NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name

MEDIUM 57CWE-79Published 2026-08-13 · Updated 2026-08-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00246 15th percentileScored 2026-11-07

Fix Fixed NodeBB (NodeBB): 4.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NodeBB	NodeBB	before 4.15.0	4.15.0	Patch available	CNA

NodeBB VendorNodeBB Affected before 4.15.0 Fixed in 4.15.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:nodebb:nodebb::::::::	—	—	NodeBB

cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:* Versions — — ·NodeBB

Remediation

Fix · CNA NodeBB (NodeBB) Fixed in 4.15.0

Timeline

2026-10-02 Threatist record created from CVE-2026-73038
2026-10-03 Alias added: GHSA-fh4m-97qj-ff6c

References

Patch 1

Patch Commit

Other 2

TI-2023-23124 A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc… CVSS 3.1CRITICAL 9.8
TI-2022-22808 Account takeover via prototype vulnerability CVSS 3.1CRITICAL 9.8
TI-2026-42173 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User CVSS 4.0HIGH 8.7
TI-2025-32286 NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint… CVSS 3.1HIGH 8.6
TI-2021-22363 NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write CVSS 4.0HIGH 8.6
TI-2023-14416 NodeBB Pre-Authentication Denial-of-Service CVSS 3.1HIGH 7.5

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences