CVE-2026-40230 is a stored cross-site scripting vulnerability affecting Helpy version 2.8.0. The issue arises from improper neutralization of input during web page generation in the knowledge base document rendering logic. Authenticated users with elevated privileges (admin or agent editor) can persist malicious HTML or JavaScript in the body field of knowledge base documents, potentially leading to script execution in the context of other users viewing the document. The vulnerability has a CVSS 4.8 score, indicating medium severity. No patch or official remediation level has been published by the vendor as of the information provided.

An attacker with admin or agent editor privileges can inject persistent malicious scripts into knowledge base documents, which may execute in the browsers of users who view those documents. This could lead to unauthorized actions performed in the context of the victim user, such as session hijacking or content manipulation. However, the requirement for elevated privileges limits the scope of exploitation. There are no reports of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict admin and agent editor privileges to trusted users only and consider reviewing or sanitizing knowledge base document content before publishing. Monitor vendor channels for updates regarding patches or official mitigations.