CVE-2026-116229— ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting

Quick assessment

Affected

ffxiv-teamcraft FFXIV Teamcraft

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 FFXIV Teamcraft（ffxiv-teamcraft）11.4.31 及更早版本中发现一个安全漏洞。受影响的是组件"Renderer-Process IPC Bridge"中文件内的函数。该函数被不当调用会导致跨站脚本（XSS）攻击。攻击者可远程实施此攻击。该漏洞利用方法已公开披露，可能被恶意利用。建议将受影响组件升级至 11.4.32 版本以修复此问题。修复补丁标识为：def118fdf36f8f3b615966893a132dd81d9cc3dc。建议尽快升级受影响组件。

CVSS 3.5 · Low Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process IPC Bridge. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 11.4.32 is recommended to address this issue. Patch name: def118fdf36f8f3b615966893a132dd81d9cc3dc. Upgrading the affected component is recommended.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ffxiv-teamcraft	FFXIV Teamcraft	11.4.0	`cpe:2.3:a:ffxiv-teamcraft:ffxiv_teamcraft::::::::`

II. Public POCs for CVE-2026-116229

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116229

请登录查看更多情报信息。

Other References for CVE-2026-116229 (6)

https://drive.google.com/drive/folders/1pxitXRLnnnl9GPnyN83ILAgWHWve3ezX?usp=sharing exploit
https://github.com/ffxiv-teamcraft/ffxiv-teamcraft/commit/def118fdf36f8f3b615966893a132dd81d9cc3dc patch
https://github.com/ffxiv-teamcraft/ffxiv-teamcraft/releases/tag/v11.4.32 patch
https://vuldb.com/cve/CVE-2026-116229 third-party-advisory
https://vuldb.com/vuln/426278/cti signature permissions-required
https://vuldb.com/submit/1007305 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116229

IV. Related Vulnerabilities

Same weakness: CWE-79