CVE-2026-80426: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in voxel51 fiftyone

FiftyOne's sidebar field-information component renders a dataset field's description string as raw HTML using React's dangerouslySetInnerHTML without escaping or sanitizing it. Since the description is stored in the dataset schema and persists in the database, an attacker can craft malicious markup that executes when a user opens a dataset and hovers over the field. The application shares its origin with a media route that returns contents of caller-named absolute paths without authentication, enabling the injected script to read local files and interact with dataset and operator endpoints as the viewing user. This cross-site scripting vulnerability affects versions before 1.21.0 and has a CVSS 4.0 score of 7.0 (high severity). No official patch or remediation level has been published yet.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the FiftyOne application origin. This can lead to reading local files via the unauthenticated media route and accessing sensitive dataset and operator endpoints as the user. The vulnerability compromises confidentiality and integrity of data accessible through the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening datasets from untrusted sources or hovering over field descriptions in such datasets. Monitor official voxel51 channels for updates and patches addressing this vulnerability.