Onyx Craft: Stored Cross-Site Scripting via iframe sandbox bypass (CVE-2026-116004)

Onyx Craft versions up to and including 5.0.0 are vulnerable to stored Cross-Site Scripting (XSS) due to an unsafe iframe sandbox configuration within the craft output preview component. The component uses both allow-scripts and allow-same-origin attributes in the iframe sandbox. When the parent application and the rendered preview share the same origin, this combination permits framed JavaScript to bypass sandbox restrictions and modify the parent document's DOM. This vulnerability is tracked as CVE-2026-116004.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript within the context of the parent application when a victim views attacker-controlled preview content. This can lead to unauthorized modification of the parent document, potential session hijacking, or data theft, depending on the privileges and sensitive information present in the parent application context.

Recommendation

• Upgrade Onyx Craft to a patched version once released.
• Implement a dedicated, isolated origin (subdomain) to serve generated preview content, ensuring it does not share cookies or application privileges with the main application.
• Remove the allow-same-origin flag from iframe sandbox configurations where application requirements permit.
• Apply a restrictive Content Security Policy (CSP) to preview content.
• Implement browser regression tests to assert that preview content cannot access or modify the parent DOM.