NodeBB Cross-site scripting (XSS) vulnerability

MEDIUM 4.6CVE-2024-57041 · GHSA-vqr3-vrrg-f3jh · Published 24/01/2025 · updated 05/07/2026

Package	Affected versions	Patched versions
nodebb nodebb	`= 3.11.0`	No fix yet
nodebb npm	`< 3.11.1`	`3.11.1`

Description

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

NVD description

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

References

nvd.nist.gov/vuln/detail/CVE-2024-57041 · ADVISORY
NodeBB/NodeBB commit 4e69bff · WEB
NodeBB/NodeBB · PACKAGE
tonysec.com/posts/cve-2024-57041 · WEB
tonysec.com/posts/cve-2024-57041 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free