---
id: CVE-2026-116556
title: Argilla TextField.vue cross site scripting
summary: >-
  A vulnerability was found in Argilla up to 2.8.0. This affects an unknown
  function of the file
  argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue.
  The manipulation of the argument text results in cr…
severity: low
cvss: 2.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-79
  - CWE-94
product: Argilla
affected:
  - Argilla 2.0
  - Argilla 2.1
  - Argilla 2.2
  - Argilla 2.3
  - Argilla 2.4
  - Argilla 2.5
  - Argilla 2.6
  - Argilla 2.7
  - Argilla 2.8.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-27T13:55:55.402047Z'
exploitAvailable: true
published: '2026-10-26'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:16:13.865Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116556'
references:
  - url: 'https://vuldb.com/vuln/426457'
    label: VDB-426457 | Argilla TextField.vue cross site scripting
  - url: 'https://vuldb.com/vuln/426457/cti'
    label: 'VDB-426457 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116556'
    label: CVE-2026-116556 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1022940'
    label: 'Submit #1022940 | Argilla up to 2.8.0 Cross Site Scripting'
  - url: 'https://github.com/argilla-io/argilla/issues/5877'
  - url: >-
      https://github.com/3em0/cve_repo/tree/main/2026/argilla-io.argilla_stored_xss_textfield_v_html/poc
tags:
  - cve.org
  - exploit-available
epss: 0.0021
epssPercentile: 0.11296
ingestedAt: '2026-10-27T16:11:59.449Z'
---

## Overview

A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The manipulation of the argument text results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

## Affected

- `Argilla 2.0`
- `Argilla 2.1`
- `Argilla 2.2`
- `Argilla 2.3`
- `Argilla 2.4`
- `Argilla 2.5`
- `Argilla 2.6`
- `Argilla 2.7`
- `Argilla 2.8.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.