Executive brief
NodeBB is an open-source forum platform used to host community discussions and user-generated content. A flaw in the profile "about me" section allows attackers to inject and store malicious code that executes when other users view the attacker's profile, potentially stealing session data or performing actions on behalf of victims.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in NodeBB v3.11.0 in the user profile "about me" section (CWE-79). The vulnerable component fails to properly escape user-supplied input before rendering it on the page, allowing an authenticated attacker to inject arbitrary JavaScript code. The injected payload is stored in the database and executes in the browser of any user who visits the attacker's profile. An attacker must have a NodeBB account to exploit this, but no special privileges are required. The attack is fixed in version 3.11.1 via input escaping.
Affected products
- NodeBB NodeBB 0 to 3.11.0
Timeline
- 2025-01-24: disclosed
- 2025-01-24: patched: Fix released in version 3.11.1