CVE-2026-55650 Details
Description
Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capable event handlers to execute when the widget is displayed. Outerbase Cloud and its backend services were discontinued in 2025, and the current architecture uses local browser dashboard storage, so the impact is limited to local self-XSS. Authentication token theft, account takeover, and backend database access are not applicable to the current architecture. No fixed release is available as of this review.
A stored cross-site scripting vulnerability has been identified in Outerbase Studio versions through 0.10.2. The issue arises in the TextComponent of the application, where unsanitized content from Text Widgets is rendered using dangerouslySetInnerHTML. This flaw allows injected markup with script-executing event handlers to run when the widget is displayed. Although Outerbase Cloud and its backend services were discontinued in 2025, leaving the application to function solely as a client-side tool with local data storage, this vulnerability still permits self-cross-site scripting within the user's browser session.
The vulnerability has been addressed by removing the unsafe HTML rendering in the Text Widget, eliminating the use of dangerouslySetInnerHTML. This fix is available in the latest commit.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/outerbase/studio/commit/b06fb85e5967440278d5a815721b360920566ab9 | [email protected] | Source CodeVendor |
| https://github.com/outerbase/studio/security/advisories/GHSA-wwf9-7jrc-rv4q | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Outerbase Studio | <= 0.10.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |