Cross-Site Scripting Vulnerability in Onyx by onyx-dot-app
CVE-2026-116004

5.1MEDIUM

Key Information:

Vendor

Onyx-dot-app

Status
Onyx
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116004?

A security vulnerability has been identified in Onyx by onyx-dot-app, specifically affecting versions up to 5.0.0. The issue arises from an unprotected function located in the file web/src/app/craft/components/output-panel/PreviewTab.tsx. This vulnerability allows for remote cross-site scripting attacks, which can potentially compromise the security of users interacting with the application. Notably, this exploit has been publicly disclosed, and the vendor has not yet taken action or responded to the notification regarding this critical issue.

Affected Version(s)

Onyx 5.0

References

https://vuldb.com/vuln/426102
vdb-entry
https://vuldb.com/vuln/426102/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116004
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

fernando viana (VulDB User)
VulDB CNA Team
.