Stored Cross-Site Scripting Vulnerability in FiftyOne by Voxel51

CVE-2026-80426

What is CVE-2026-80426?

The FiftyOne application is susceptible to a stored cross-site scripting vulnerability due to improper handling of dataset field descriptions. The application uses React's dangerouslySetInnerHTML method without sanitizing the input from dataset schemas, allowing an attacker to inject malicious scripts. This vulnerability is particularly concerning as it can be exploited when a user views datasets obtained from untrusted sources. The unescaped markup can lead to unauthorized script execution within the application context, compromising data integrity and user security. To mitigate this issue, it is recommended to update to FiftyOne version 1.21.0 or later, which includes necessary security enhancements.

References