CVE-2026-71802 Cross-site scripting in n/a
Stored XSS in REBUILD announcement preview allows attackers to execute arbitrary JavaScript in user browsers via malicious content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-71802?
CVE-2026-71802 is a medium-severity cross-site scripting vulnerability in n/a, published on 9 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages "which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.
Weakness: CWE-79
Which versions are affected by CVE-2026-71802?
How do I fix CVE-2026-71802?
No fix has been published for CVE-2026-71802 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-71802 being exploited?
There is no known exploitation of CVE-2026-71802 in the wild and no public exploit code.
Sources
Also known as GHSA-8wq2-j7c6-cq65.