Low severity · published Oct 26, 2026
CVE-2026-116229
ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting
New
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process IPC Bridge. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 11.4.32 is recommended to address this issue. Patch name: def118fdf36f8f3b615966893a132dd81d9cc3dc. Upgrading the affected component is recommended.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FT
FFXIV Teamcraft · ffxiv-teamcraft
11.4.0; 11.4.1; 11.4.2; 11.4.3; 11.4.4; 11.4.5; +26 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116229
drive.google.com
https://drive.google.com/drive/folders/1pxitXRLnnnl9GPnyN83ILAgWHWve3ezX?usp=sharing
github.com
https://github.com/ffxiv-teamcraft/ffxiv-teamcraft/commit/def118fdf36f8f3b615966893a132dd81d9cc3dc
github.com
https://github.com/ffxiv-teamcraft/ffxiv-teamcraft/releases/tag/v11.4.32
vuldb.com
https://vuldb.com/cve/CVE-2026-116229
vuldb.com
https://vuldb.com/submit/1007305
vuldb.com
https://vuldb.com/vuln/426278