Threats affecting pkg:pypi/argilla

CVE-2026-116556 is a cross-site scripting (XSS) vulnerability in Argilla versions 2.0 through 2.8.0. It arises from improper handling of the 'text' argument in a frontend Vue component, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 4.8 and public exploit code is available. The Argilla project has been notified but has not yet issued a response or patch.

CVE-2026-116555 is a cross-site scripting (XSS) vulnerability in Argilla up to version 2.8.0. It arises from improper handling of the 'template' argument in a component file within the frontend codebase. The vulnerability allows remote attackers to inject malicious scripts. Public exploit code has been disclosed, but no official response or patch has been issued by the project as of the publication date.