Stored Cross-Site Scripting Vulnerability in NodeBB by NodeBB

CVE-2026-73038

What is CVE-2026-73038?

NodeBB versions prior to 4.15.0 are susceptible to a stored cross-site scripting vulnerability found within the renderEmoji function. This vulnerability arises from the failure to properly escape attributes such as tag.icon.url and tag.name, allowing attackers to deliver malicious ActivityPub Create/Note objects. By crafting these emoji tags, an attacker can insert arbitrary HTML and JavaScript into stored posts, leading to the execution of code in the browsers of users who view the compromised content.

References