Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-123094 Details

Description

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/huginn/huginn	[email protected]
https://github.com/huginn/huginn/blob/v2026.11.01/app/helpers/application_helper.rb#L78-L88	[email protected]
https://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b	[email protected]
https://github.com/huginn/huginn/releases/tag/v2026.11.05	[email protected]
https://github.com/huginn/huginn/security/advisories/GHSA-rjw9-xx87-f2ww	[email protected]
https://hackmd.io/@leediay/SJtUoLFTfx	[email protected]
https://www.vulncheck.com/advisories/huginn-before-2026.11.05-stored-xss-via-oauth-service-display-name	[email protected]

see all 7 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes