Executive brief
REBUILD is a web application that displays system announcements to users on dashboards, activity feeds, and login pages. A vulnerability in the announcement preview component allows attackers with announcement publishing permission to inject malicious JavaScript that executes in users' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of affected users.
Technical details
A stored XSS vulnerability exists in the announcement preview component due to improper handling of HTML-escaped content. Although the server-side code correctly escapes announcement content using CommonsUtils.escapeHtml(), the frontend code reverses this escaping by using jQuery's html().text() method (via a $removeHtml function) and then injects the unescaped result into the DOM using React's dangerouslySetInnerHTML. An attacker with permission to create or modify announcements can craft payloads containing HTML/JavaScript that, after double-decoding, are executed in the browsers of all users viewing the affected announcement. The vulnerability affects REBUILD version 4.4.3 and potentially earlier versions. No patch information is currently available.
Affected products
- REBUILD REBUILD 4.4.3 and earlier
Timeline
- 2026-07-20: disclosed: Issue #6 reported on GitHub
- 2026-09-09: advisory: CVE-2026-71802 published on NVD