PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-116554 argilla-io CVE debrief

A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in the Dataset.from_disk function of the SettingsInfo.vue file. This issue allows remote attackers to execute cross-site scripting attacks by manipulating the Name argument. The vulnerability has been publicly disclosed and may be used by attackers. Defenders should assess the potential impact on their systems and prioritize verification and mitigation efforts. The CVE record and source item provide details about the vulnerability, but further verification is needed to confirm affected versions and exploitation.

Vendor
argilla-io
Product
Argilla
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-26
Original CVE updated
2026-10-31
Advisory published
2026-10-26
Advisory updated
2026-10-31

Who should care

Defenders responsible for Argilla instances should assess the potential impact of this vulnerability on their systems and prioritize verification and mitigation efforts. This includes reviewing system configurations, verifying the presence of affected versions, and implementing security measures to prevent cross-site scripting attacks. Additionally, defenders should track exceptions, retest remediated assets, and close the item only after evidence is

Why it matters

CVE-2026-116554 is a cross-site scripting vulnerability in Argilla up to 2.8.0 that allows remote attackers to execute cross-site scripting attacks by manipulating the Name argument in the Dataset.from_disk function of the SettingsInfo.vue file.

  • Cross-site scripting attacks can lead to unauthorized actions on behalf of users.
  • Successful exploitation can result in the injection of malicious scripts into user sessions.
  • Defenders should verify the presence of this vulnerability in their Argilla instances and assess the potential impact on their systems.
  • Remediation efforts should focus on updating Argilla to a version that addresses this vulnerability.

Technical summary

The Dataset.from_disk function in the SettingsInfo.vue file of Argilla up to 2.8.0 is vulnerable to cross-site scripting attacks. This issue allows remote attackers to execute cross-site scripting attacks by manipulating the Name argument. The vulnerability exists due to insufficient input validation and sanitization. Defenders should prioritize verifying the presence of this vulnerability in their Argilla instances and assess the potential impact on their systems. The CVE record and source item provide details about the vulnerability, but further verification is needed to confirm affected versions and exploitation.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Argilla instances and assess the potential impact on their systems.

Recommended defensive actions

  • Verify the presence of Argilla up to 2.8.0 in your environment.
  • Assess the potential impact of cross-site scripting attacks on your systems.
  • Implement security measures to prevent cross-site scripting attacks.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its existence in Argilla up to version 2.8.0 and the potential for remote exploitation. However, the record of exploitation and affected versions requires further verification.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-116554 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-116554

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-116554 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-116554

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116554.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/426455

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/426455/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-116554

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/1022934

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/argilla-io/argilla/issues/5875

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/3em0/cve_repo/tree/main/2026/argilla.argilla_stored_xss_dataset_name/poc

    Supplemental source - exploit

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.