Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Sharetribe Go - #VU159643
Published: November 6, 2026
Vulnerability identifier: #VU159643
CSH Severity: Medium
CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-80
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to execute malicious JavaScript in an administrator's browser and potentially compromise the administrator's session.
The vulnerability exists due to unsafe rendering of user-controlled values in Sharetribe Go admin panel elements triggered by user, listing, or review management actions. An authenticated attacker can inject script into a user name or listing title and have it execute when an administrator triggers a corresponding context-menu management action.
Affected software
Sharetribe Go
Remediation
Install security update from vendor's website.
Sharetribe Go - update to 13.0.0