Cross-site Scripting in NodeBB

MEDIUM 6.1CVE-2015-9286 · GHSA-72fv-qgj6-2w2p · Published 30/04/2019 · updated 17/06/2026

In short

CVE-2015-9286 is a MEDIUM (CVSS 6.1) vulnerability affecting nodebb (nodebb), nodebb.
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 71.7% of all vulnerabilities.
Fix: update to 0.7.3, 0.8.2 or later.

Package	Affected versions	Patched versions
nodebb nodebb	`< 0.7.3`	`0.7.3`
nodebb npm	`< 0.8.2`	`0.8.2`

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.

NVD description

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 0.7.3

0.7.3

npm

< 0.8.2

0.8.2

More vulnerabilities in nodebb

See all →