Description

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-13T19:17:34.110Z",
  "pubdate": "2026-08-13T19:17:34.110Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in NodeBB before 4.15.0 within the renderEmoji function. The vulnerability arises from a failure to properly sanitize and escape the tag.icon.url and tag.name attributes when processing custom emoji tags.\nAttackers can leverage this flaw by delivering malicious ActivityPub Create or Note objects containing crafted emoji tags. When processed and rendered by the application, these malicious inputs inject arbitrary HTML and JavaScript payloads directly into stored post content.\nThe impact of this vulnerability is severe, as the injected scripts execute within the context of any viewer's browser when they access the affected post. This allows unauthorized actors to perform actions on behalf of the victim, hijack user sessions, steal sensitive data, or deface the application interface.\nAffected systems include deployments of NodeBB prior to version 4.15.0 that process external ActivityPub interactions or handle untrusted emoji tag data. Exploitation requires the ability to transmit crafted ActivityPub objects to the target instance, resulting in persistent code execution across multiple clients without requiring explicit user interaction beyond viewing the compromised content.",
  "technicalDetails": "The vulnerability is rooted in the renderEmoji function within NodeBB, which processes emoji metadata associated with posts and rich text inputs. Specifically, the function fails to adequately encode or sanitize dynamic attributes, namely tag.icon.url and tag.name, before incorporating them into the Document Object Model (DOM) or rendering them within HTML output.\nBecause NodeBB supports federated interactions via ActivityPub, an external or internal attacker can construct malicious payloads encapsulated within ActivityPub Create or Note objects. Within these objects, the attacker crafts malicious emoji tag definitions where properties such as the icon URL or emoji name contain malicious HTML markup or JavaScript event handlers, such as img tags with onerror attributes or anchor tags with javascript URIs.\nThe step-by-step attack flow begins when the attacker transmits a crafted ActivityPub Create or Note object containing the malicious emoji payload to the vulnerable NodeBB instance. Upon receipt and processing, the NodeBB backend parses the object and invokes the vulnerable renderEmoji function. Because the function fails to sanitize tag.icon.url and tag.name, the unescaped malicious payload is stored persistently within the database as part of the post content.\nWhen any authenticated or unauthenticated user subsequently requests and views the compromised post, the stored payload is retrieved from the database and rendered by the browser. The execution of the arbitrary JavaScript occurs immediately in the victim's browser session, bypassing security boundaries and operating with the privileges of the viewing user.\nThe affected component is the renderEmoji function in NodeBB versions prior to 4.15.0. The vulnerability allows for stored XSS via the network attack vector, exploiting the application's trust in incoming ActivityPub data structures without necessitating prior authentication or high-level privileges on the target node."
}