{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/onyx-craft--5.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:onyx:craft:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":3.5,"id":"CVE-2026-116004"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Onyx Craft (\u003c= 5.0.0)"],"_cs_severities":["low"],"_cs_tags":["xss","web-vulnerability","cve-2026-116004"],"_cs_type":"advisory","_cs_vendors":["Onyx"],"content_html":"\u003cp\u003eOnyx Craft versions up to and including 5.0.0 are vulnerable to stored Cross-Site Scripting (XSS) due to an unsafe iframe sandbox configuration within the craft output preview component. The component uses both \u003ccode\u003eallow-scripts\u003c/code\u003e and \u003ccode\u003eallow-same-origin\u003c/code\u003e attributes in the iframe sandbox. When the parent application and the rendered preview share the same origin, this combination permits framed JavaScript to bypass sandbox restrictions and modify the parent document's DOM. This vulnerability is tracked as CVE-2026-116004.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to execute arbitrary JavaScript within the context of the parent application when a victim views attacker-controlled preview content. This can lead to unauthorized modification of the parent document, potential session hijacking, or data theft, depending on the privileges and sensitive information present in the parent application context.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Onyx Craft to a patched version once released.\u003c/li\u003e\n\u003cli\u003eImplement a dedicated, isolated origin (subdomain) to serve generated preview content, ensuring it does not share cookies or application privileges with the main application.\u003c/li\u003e\n\u003cli\u003eRemove the \u003ccode\u003eallow-same-origin\u003c/code\u003e flag from iframe sandbox configurations where application requirements permit.\u003c/li\u003e\n\u003cli\u003eApply a restrictive Content Security Policy (CSP) to preview content.\u003c/li\u003e\n\u003cli\u003eImplement browser regression tests to assert that preview content cannot access or modify the parent DOM.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T01:09:20Z","date_published":"2026-10-27T01:09:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-onyx-craft-xss/","summary":"Onyx Craft versions through 5.0.0 contain a stored Cross-Site Scripting vulnerability in the output preview panel caused by insecure iframe sandbox configuration, allowing malicious preview content to access the parent document DOM.","title":"Onyx Craft: Stored Cross-Site Scripting via iframe sandbox bypass (CVE-2026-116004)","url":"https://feed.craftedsignal.io/briefs/2026-10-onyx-craft-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Onyx Craft (\u003c= 5.0.0)","version":"https://jsonfeed.org/version/1.1"}