Low severity · published Oct 25, 2026
CVE-2026-116004
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
New
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
Onyx · onyx-dot-app
5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116004
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116004
github.com
https://github.com/onyx-dot-app/onyx/
github.com
https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-grhq-88h5-2h86
vuldb.com
https://vuldb.com/cve/CVE-2026-116004
vuldb.com
https://vuldb.com/submit/992835
vuldb.com
https://vuldb.com/vuln/426102
vuldb.com
https://vuldb.com/vuln/426102/cti
More from Onyx
9.8
CVE-2025-7894
A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1
8.1
CVE-2024-7767
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94
6.5
CVE-2026-42277
Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
6.5
CVE-2024-9612
In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page
5.4
CVE-2025-51479
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH…