Read the docs
TI-2026-85476 Aliases CVE-2026-123094GHSA-wjrx-rm4h-jrhj

Stored cross-site scripting in Huginn via OAuth service display name

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Huginn before 2026.11.05 has a stored cross-site scripting flaw in the service_label helper, which marks unescaped OAuth service display names as html_safe, CWE-79. An authenticated attacker with low privileges can connect an OAuth account with a crafted nickname, name or email and share it globally. JavaScript runs in the browser of a victim who attaches the service to Agents and views them, which can expose Credentials, Agents and Events, and perform admin actions if the victim is an administrator.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

Why it matters now

EPSS 0.00178 7th percentileScored 2026-11-07
Fix Fixed huginn (huginn): 2026.11.05

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
huginnhuginnbefore 2026.11.052026.11.05Patch availableCNA
  • huginn Vendorhuginn Affected before 2026.11.05 Fixed in 2026.11.05 Patch available CNA

Remediation

Upgrade huginn to version 2026.11.05 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA huginn (huginn) Fixed in 2026.11.05

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123094
  2. 2026-11-05 Alias added: GHSA-wjrx-rm4h-jrhj
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 2

Other 3

  • TI-2026-45356 Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences