CVE-2020-10146 Microsoft Teams displayName stored cross-site scripting vulnerability
Stored XSS in Microsoft Teams displayName allows attackers to steal authentication tokens and potentially execute arbitrary commands.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-10146?
CVE-2020-10146 is a medium-severity cross-site scripting vulnerability in Microsoft Teams, published on 9 Dec 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020.
Weakness: CWE-79
Which versions are affected by CVE-2020-10146?
It affects 1 product.
Products include Microsoft Teams.
How do I fix CVE-2020-10146?
No fix has been published for CVE-2020-10146 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-10146 being exploited?
There is no known exploitation of CVE-2020-10146 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Teams
- CVE-2026-65667 Microsoft Teams Elevation of Privilege Vulnerability
- CVE-2026-62896 Microsoft Teams Elevation of Privilege Vulnerability
- CVE-2026-33823 Microsoft Team Events Portal Information Disclosure Vulnerability
- CVE-2026-65767 Microsoft Teams for Android Spoofing Vulnerability
- CVE-2026-65768 Microsoft Teams Remote Code Execution Vulnerability
Sources
Also known as GHSA-8jq9-gwrr-4cqw.