Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123094— Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name

Quick assessment

Affected
huginn huginn
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 2026.11.05 版本之前的 Huginn 中， 辅助函数存在存储型跨站脚本（Stored XSS）漏洞。该函数将未转义的 OAuth 服务显示名称标记为 （即视为安全 HTML）。已认证的攻击者可以通过注册一个经过精心构造的昵称、名称或电子邮件的 OAuth 账户，并将其全局共享。当受害者将该账户关联到代理（Agent）并查看时，攻击者即可执行恶意 JavaScript 代码，从而窃取凭证、代理和事件数据；若受害者为管理员，攻击者还可执行管理员操作。

CVSS 5.4 · Medium EPSS 0.18% · P7

Affected Version Matrix 1

VendorProduct Version RangeStatus
huginn huginn < 2026.11.05 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123094

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name
Source: CVE Program / CVE List V5
Vulnerability Description
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
huginn huginn 0 ~ 2026.11.05 -

II. Public POCs for CVE-2026-123094

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123094

请登录查看更多情报信息。

Other References for CVE-2026-123094 (7)

IV. Related Vulnerabilities

Same product: huginn
Same vendor: huginn
Same weakness: CWE-79