# CVE-2024-57041: NodeBB persistent cross-site scripting in profile

Source: https://junglewise.ai/threats/cve-2024-57041-nodebb-persistent-cross-site-scripting-in-profile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-01-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-57041 · Severity: low · CVSS 3.1 · Published 2025-01-24

NodeBB is an open-source forum platform used to host community discussions and user-generated content. A flaw in the profile "about me" section allows attackers to inject and store malicious code that executes when other users view the attacker's profile, potentially stealing session data or performing actions on behalf of victims.

Technologies: [NodeBB](https://junglewise.ai/threats/technologies/nodebb). Vendors: [NodeBB](https://junglewise.ai/threats/vendors/nodebb).

## Quick answers

**Is CVE-2024-57041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-57041 being exploited in the wild.

**How severe is CVE-2024-57041?** Low severity, with a CVSS score of 3.1, published 24 January 2025.

**Which products and versions are affected?** NodeBB 0 to 3.11.0.

**Is there a fix for CVE-2024-57041?** A patch was published on 2025-01-24: Fix released in version 3.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-57041 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2024-57041?** Check whether you run NodeBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A persistent cross-site scripting (XSS) vulnerability exists in NodeBB v3.11.0 in the user profile "about me" section (CWE-79). The vulnerable component fails to properly escape user-supplied input before rendering it on the page, allowing an authenticated attacker to inject arbitrary JavaScript code. The injected payload is stored in the database and executes in the browser of any user who visits the attacker's profile. An attacker must have a NodeBB account to exploit this, but no special privileges are required. The attack is fixed in version 3.11.1 via input escaping.

## Affected products

- NodeBB NodeBB 0 to 3.11.0

## Identifiers

- CVE-2024-57041
- GHSA-vqr3-vrrg-f3jh

## Timeline

- 2025-01-24: disclosed
- 2025-01-24: patched: Fix released in version 3.11.1

## References

- [https://github.com/NodeBB/NodeBB/commit/4e69bff72fd04779064d37e46a43080e6c328adf](https://github.com/NodeBB/NodeBB/commit/4e69bff72fd04779064d37e46a43080e6c328adf)

## Related threats

- [NodeBB authorization bypass in user registration](https://junglewise.ai/threats/cve-2026-120007-nodebb-1-18-0-through-4-16-5-contains-an-authorization-bypass)
- [NodeBB author spoofing via unvalidated ActivityPub attributedTo field](https://junglewise.ai/threats/cve-2026-58593-nodebb-author-spoofing-via-unvalidated-activitypub-attributedto)
- [NodeBB SQL injection in search-categories endpoint](https://junglewise.ai/threats/cve-2025-50979-nodebb-sql-injection-in-search-categories-endpoint)
- [NodeBB incorrect access control in admin tabs](https://junglewise.ai/threats/cve-2024-29316-nodebb-incorrect-access-control-in-admin-tabs)
- [NodeBB cross-origin WebSocket session hijacking](https://junglewise.ai/threats/cve-2023-2850-nodebb-cross-origin-websocket-session-hijacking)