Description

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-10T21:17:24.370Z",
  "pubdate": "2026-08-10T21:17:24.370Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in SQLBot through version 1.10.0, specifically within the SQText dashboard component. The flaw arises from the insecure rendering of TinyMCE output via the v-html directive without proper input sanitization. This security deficiency allows authenticated attackers capable of modifying dashboard text widget content to inject arbitrary HyperText Markup Language (HTML) and malicious JavaScript into the application. When other users access and view the compromised dashboard, the injected payload executes within the context of their browser sessions. The potential impact of this vulnerability includes unauthorized session hijacking, credential theft, the execution of arbitrary actions on behalf of the victim, and potential compromise of sensitive dashboard data. Exploitation requires the attacker to possess the privileges necessary to modify dashboard text widgets, after which the malicious payload remains persistently stored and automatically executed for all subsequent viewers of the affected dashboard.",
  "technicalDetails": "The vulnerability is located in the SQText dashboard component of SQLBot through version 1.10.0. The root cause of the issue stems from the improper handling and rendering of rich text content generated by the TinyMCE editor. Specifically, the application utilizes the Vue.js v-html directive to render the raw HTML output from TinyMCE directly into the Document Object Model (DOM) without applying requisite sanitization or encoding mechanisms.\nBecause the v-html directive instructs the framework to interpret the bound string as raw HTML rather than plain text, any malicious markup or script tags embedded within the content are parsed and executed by the victim's browser. Attackers exploit this behavior by leveraging an interface or permission set that permits the modification of dashboard text widget content. By supplying a crafted payload containing malicious JavaScript—such as event handlers or script tags—within a text widget, the attacker successfully stores the malicious payload persistently within the application backend data store.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious payload designed to execute arbitrary JavaScript within the context of a victim's session. Second, the attacker leverages dashboard modification capabilities to insert this payload into an SQText dashboard text widget. Third, the application stores the unsanitized payload in the database without validation or filtering. Fourth, a victim user navigates to or loads the affected dashboard. Fifth, the application retrieves the stored widget content and renders it via v-html. Sixth, the victim's browser parses the injected HTML and executes the embedded JavaScript payload.\nThe execution of the arbitrary JavaScript payload occurs automatically within the browser of any user viewing the dashboard, bypassing further authentication checks since the payload executes within the victim's authenticated session. This enables post-exploitation activities such as performing unauthorized administrative actions, exfiltrating session cookies, or interacting with internal application endpoints using the victim's privileges."
}