Executive brief
Outerbase Studio, a tool for managing and visualizing database data, was found to have a security flaw in its dashboard text widget. An attacker could potentially embed malicious code that executes when a user views a specific dashboard. While this could previously lead to account takeover, the impact is now limited to the local browser session because the product's cloud services have been discontinued.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Text Widget of Outerbase Studio's dashboard. The root cause is the use of the `dangerouslySetInnerHTML` React property, which renders unsanitized HTML input. An attacker can exploit this by inserting a malicious payload (e.g., an image tag with an `onerror` handler) into a dashboard widget. While historically this could be used for authentication token theft, the current client-side architecture limits the impact to local self-XSS. The issue has been remediated by removing unsafe HTML rendering in the affected component.
Affected products
- Outerbase Studio <= 0.10.2
Timeline
- 2026-06-19: advisory: GitHub Advisory GHSA-wwf9-7jrc-rv4q published
- 2026-06-19: patched: Fix committed to the repository
References
- https://api.github.com/users/hunt-with-4bh1
- https://github.com/hunt-with-4bh1
- https://api.github.com/users/hunt-with-4bh1/gists%7B/gist_id%7D
- https://api.github.com/users/hunt-with-4bh1/repos
- https://avatars.githubusercontent.com/u/226230214?v=4
- https://api.github.com/users/hunt-with-4bh1/events%7B/privacy%7D