Cve-2026-116004

Onyx Craft versions through 5.0.0 contain a stored Cross-Site Scripting vulnerability in the output preview panel caused by insecure iframe sandbox configuration, allowing malicious preview content to access the parent document DOM.