# CVE-2026-71802: REBUILD announcement preview stored XSS via HTML entity decoding

Source: https://junglewise.ai/threats/cve-2026-71802-rebuild-announcement-preview-stored-xss-via-html-entity-decoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-71802 · Severity: medium · CVSS 5.4 · Published 2026-09-09

REBUILD is a web application that displays system announcements to users on dashboards, activity feeds, and login pages. A vulnerability in the announcement preview component allows attackers with announcement publishing permission to inject malicious JavaScript that executes in users' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of affected users.

Technologies: [REBUILD](https://junglewise.ai/threats/technologies/rebuild). Vendors: [REBUILD](https://junglewise.ai/threats/vendors/rebuild).

## Quick answers

**Is CVE-2026-71802 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71802 being exploited in the wild.

**How severe is CVE-2026-71802?** Medium severity, with a CVSS score of 5.4, published 9 September 2026.

**Which products and versions are affected?** REBUILD 4.4.3 and earlier.

**Is there a fix for CVE-2026-71802?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71802 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-71802?** Check whether you run REBUILD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored XSS vulnerability exists in the announcement preview component due to improper handling of HTML-escaped content. Although the server-side code correctly escapes announcement content using CommonsUtils.escapeHtml(), the frontend code reverses this escaping by using jQuery's html().text() method (via a $removeHtml function) and then injects the unescaped result into the DOM using React's dangerouslySetInnerHTML. An attacker with permission to create or modify announcements can craft payloads containing HTML/JavaScript that, after double-decoding, are executed in the browsers of all users viewing the affected announcement. The vulnerability affects REBUILD version 4.4.3 and potentially earlier versions. No patch information is currently available.

## Affected products

- REBUILD REBUILD 4.4.3 and earlier

## Timeline

- 2026-07-20: disclosed: Issue #6 reported on GitHub
- 2026-09-09: advisory: CVE-2026-71802 published on NVD

## References

- [https://github.com/W000i/vuln/issues/6](https://github.com/W000i/vuln/issues/6)

## Related threats

- [REBUILD authorization bypass in FeedsListController](https://junglewise.ai/threats/cve-2026-125372-rebuild-before-4-5-3-contains-an-authorization-bypass)
- [REBUILD authorization bypass in task comment listing](https://junglewise.ai/threats/cve-2026-111667-rebuild-through-4-5-0-contains-a-missing-authorization)
- [REBUILD authorization bypass in AiBot2Controller](https://junglewise.ai/threats/cve-2026-110611-rebuild-through-4-5-0-contains-an-authorization-bypass)