{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123094", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T12:22:12.771Z", "datePublished": "2026-11-05T15:11:49.251Z", "dateUpdated": "2026-11-05T15:11:49.251Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T15:11:49.251Z"}, "datePublic": "2026-11-04T18:37:22.000Z", "title": "Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name", "descriptions": [{"lang": "en", "value": "Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "huginn", "product": "huginn", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "2026.11.05", "status": "affected", "versionType": "custom"}], "packageURL": "pkg:github/huginn/huginn", "repo": "https://github.com/huginn/huginn"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/huginn/huginn/security/advisories/GHSA-rjw9-xx87-f2ww", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-rjw9-xx87-f2ww)"}, {"url": "https://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b", "tags": ["patch"]}, {"url": "https://github.com/huginn/huginn/blob/v2026.11.01/app/helpers/application_helper.rb#L78-L88", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@leediay/SJtUoLFTfx", "tags": ["third-party-advisory"]}, {"url": "https://github.com/huginn/huginn/releases/tag/v2026.11.05", "tags": ["release-notes"], "name": "huginn v2026.11.05 Release Notes"}, {"url": "https://github.com/huginn/huginn", "tags": ["product"]}, {"name": "VulnCheck Advisory: Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/huginn-before-2026.11.05-stored-xss-via-oauth-service-display-name"}], "credits": [{"lang": "en", "value": "leediay153 from Viettel Post", "type": "finder"}, {"lang": "en", "value": "Akinori Musha", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/huginn/huginn", "product": "huginn", "repo": "https://github.com/huginn/huginn", "vendor": "huginn", "versions": [{"lessThan": "2026.11.05", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator."}], "id": "CVE-2026-123094", "lastModified": "2026-11-05T16:17:46.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-05T16:17:46.390", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/huginn/huginn"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/huginn/huginn/blob/v2026.11.01/app/helpers/application_helper.rb#L78-L88"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/huginn/huginn/releases/tag/v2026.11.05"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/huginn/huginn/security/advisories/GHSA-rjw9-xx87-f2ww"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@leediay/SJtUoLFTfx"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/huginn-before-2026.11.05-stored-xss-via-oauth-service-display-name"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "huginn: Huginn: Stored cross-site scripting via crafted OAuth service display names", "id": "2567674", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567674"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in Huginn. The application improperly handles OAuth service display names, resulting in a stored cross-site scripting (XSS) vulnerability. An authenticated attacker can exploit this issue by registering an account with crafted display names or email addresses and sharing it globally across the platform. When other users or administrators view agents linked to the malicious service, arbitrary script executes within their browser sessions, potentially exposing sensitive credentials and enabling unauthorized actions."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123094", "public_date": "2026-11-05T15:11:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123094\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123094\nhttps://github.com/huginn/huginn\nhttps://github.com/huginn/huginn/blob/v2026.11.01/app/helpers/application_helper.rb#L78-L88\nhttps://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b\nhttps://github.com/huginn/huginn/releases/tag/v2026.11.05\nhttps://github.com/huginn/huginn/security/advisories/GHSA-rjw9-xx87-f2ww\nhttps://hackmd.io/@leediay/SJtUoLFTfx\nhttps://www.vulncheck.com/advisories/huginn-before-2026.11.05-stored-xss-via-oauth-service-display-name"], "statement": "This vulnerability is rated as a Moderate impact because successful exploitation requires an authenticated attacker and relies on victim interaction to trigger script execution within another user's session. Huginn is not packaged or distributed in Red Hat Enterprise Linux or other Red Hat product portfolios. In environments where this service is independently deployed, the impact is confined to the web interface and the privileges of the interacting user rather than permitting operating system access.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.11.05)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "huginn", "source": "cna", "vendor": "huginn"}, "product": "huginn", "vendor": "huginn"}], "created": "2026-11-05T16:45:06.032081+00:00", "updated": "2026-11-05T16:45:06.275053+00:00", "vendors": ["huginn", "huginn$PRODUCT$huginn"]}