CVE-2026-78213: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Hepta Platforms Heptabase

CVE-2026-78213 is a stored Cross-Site Scripting vulnerability (CWE-79) in Heptabase by Hepta Platforms. Authenticated attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript execution in the context of other users who click the crafted content. The CVSS v3.1 score is 8.7, reflecting high impact on confidentiality and integrity with network attack vector, low attack complexity, and requiring privileges and user interaction. No patch or remediation information is currently available, and no known exploits are reported in the wild.

Successful exploitation allows attackers to execute arbitrary JavaScript in the browsers of other users, potentially leading to theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of the victim user. The vulnerability impacts confidentiality and integrity but does not affect system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting authenticated user privileges and exercising caution when interacting with user-generated content.