Description

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capable event handlers to execute when the widget is displayed. Outerbase Cloud and its backend services were discontinued in 2025, and the current architecture uses local browser dashboard storage, so the impact is limited to local self-XSS. Authentication token theft, account takeover, and backend database access are not applicable to the current architecture. No fixed release is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-15T15:17:19.090Z",
  "pubdate": "2026-09-15T15:17:19.090Z",
  "executiveSummary": "Outerbase Studio versions 0.10.2 and earlier are susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing within the TextComponent of the application's charting module.\nThe vulnerability arises from the improper sanitization of user-supplied data rendered via the dangerouslySetInnerHTML React property. This allows an attacker to inject arbitrary HTML and script-based event handlers into the Text Widget.\nUpon rendering, these malicious payloads execute within the security context of the user's browser session. Due to the discontinuation of Outerbase Cloud and the transition to local browser-based dashboard storage, the exploitability is confined to a self-XSS scenario.\nThe primary risk implications involve the manipulation of local dashboard data or the execution of unauthorized actions within the victim's local browser environment.\nThe attack does not facilitate remote exploitation, backend database access, or authentication token theft, as the application architecture no longer utilizes remote backend services. Successful exploitation requires the user to interact with a crafted widget containing the malicious payload.",
  "technicalDetails": "The vulnerability is located in src/components/chart/index.tsx within the TextComponent. The root cause is the usage of the dangerouslySetInnerHTML React property to render unsanitized content derived from the Text Widget input fields.\nBy design, React's dangerouslySetInnerHTML is intended to be used with extreme caution, as it bypasses the framework's standard XSS protection mechanisms. In Outerbase Studio, user-provided content is passed directly into this property without undergoing a sanitization process, such as DOMPurify or equivalent filtering libraries.\nThe exploitation flow is initiated when a user or an attacker inputs malicious HTML tags—specifically those utilizing script-capable event handlers such as 'onmouseover', 'onerror', or 'onload'—into the Text Widget settings. For example, a payload such as '<img src=x onerror=alert(document.domain)>' would be persisted in the local browser storage.\nWhen the TextComponent subsequently attempts to display the stored widget content, the browser parses the injected markup. Because the application fails to sanitize or escape the input, the browser executes the embedded JavaScript in the context of the current origin.\nGiven that the current architecture of Outerbase Studio relies on local browser dashboard storage, the vulnerability is classified as self-XSS. The impact is isolated to the local environment of the user who saves and views the widget. Since there are no active backend services or remote authentication tokens to harvest, the potential for traditional XSS-based session hijacking or backend database compromise is neutralized.\nThe execution of the injected code occurs solely within the victim's browser session when the vulnerable component mounts and processes the tainted data. No network interaction is required for the payload to trigger, as the data is served directly from the local browser storage engine used by the Studio interface. As of this analysis, no official security patch or version update has been released to address the underlying lack of input sanitization in the TextComponent."
}