---
id: CVE-2026-123094
title: Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name
summary: >-
  Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability
  in the service_label helper that marks unescaped OAuth service display names
  as html_safe. Authenticated attackers can connect an OAuth account with a
  crafted …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: huginn
product: huginn
affected:
  - huginn < 2026.11.05
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:11:49.251Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123094'
references:
  - url: 'https://github.com/huginn/huginn/security/advisories/GHSA-rjw9-xx87-f2ww'
    label: GitHub Security Advisory (GHSA-rjw9-xx87-f2ww)
  - url: >-
      https://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b
  - url: >-
      https://github.com/huginn/huginn/blob/v2026.11.01/app/helpers/application_helper.rb#L78-L88
  - url: 'https://hackmd.io/@leediay/SJtUoLFTfx'
  - url: 'https://github.com/huginn/huginn/releases/tag/v2026.11.05'
    label: huginn v2026.11.05 Release Notes
  - url: 'https://github.com/huginn/huginn'
  - url: >-
      https://www.vulncheck.com/advisories/huginn-before-2026.11.05-stored-xss-via-oauth-service-display-name
    label: >-
      VulnCheck Advisory: Huginn before 2026.11.05 Stored XSS via OAuth Service
      Display Name
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.894Z'
epss: 0.00178
epssPercentile: 0.07413
---

## Overview

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

## Affected

- `huginn < 2026.11.05`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.