CVE-2026-71802: REBUILD 4.4.3 Stored XSS Vulnerability

CVE-2026-71802 Overview

CVE-2026-71802 is a stored Cross-Site Scripting (XSS) vulnerability in the announcement preview component of REBUILD 4.4.3. The server escapes announcement content as HTML on submission. However, the client-side preview code reverses the escaping using jQuery's html().text() chain and injects the result back into the Document Object Model (DOM). An administrator or attacker who controls announcement content can execute arbitrary JavaScript in the browsers of users viewing affected pages. Impacted views include the dashboard, activity feed, and login page depending on announcement visibility settings.

Critical Impact
Attackers with announcement-authoring privileges can execute arbitrary JavaScript in the browsers of REBUILD 4.4.3 users, including unauthenticated visitors of the login page when announcements are set to public visibility.

Affected Products

REBUILD 4.4.3
REBUILD announcement preview component
REBUILD dashboard, activity feed, and login page rendering paths

Discovery Timeline

2026-09-09 - CVE-2026-71802 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71802

Vulnerability Analysis

The flaw is a stored Cross-Site Scripting (XSS) issue [CWE-79] in the announcement preview logic of REBUILD 4.4.3. Announcement text is stored after server-side HTML escaping, which would normally neutralize embedded markup. The preview component then undoes that protection on the client. Because the un-escaped string is written back into the DOM through jQuery's html() sink, any script payload contained in the announcement executes in the viewer's session context.

The scope of impact depends on where the announcement renders. When announcements appear on the login page, unauthenticated users are exposed. When they appear on the dashboard or activity feed, authenticated users are exposed and session cookies, CSRF tokens, and in-application actions are reachable by the injected script.

Root Cause

The root cause is a client-side output-encoding failure. The pattern $(...).html($(...).text()) reads the escaped text (for example <script>), converts entities back into raw characters (<script>), and then assigns the result to html(). That final assignment parses the string as markup and inserts live nodes. Server-side escaping is therefore bypassed at render time.

Attack Vector

An attacker requires the ability to create or modify announcement content, which typically means an administrative or otherwise privileged account. Once a malicious announcement is stored, exploitation is passive: every user who loads a page displaying the announcement executes the payload. If announcement visibility is set to include the login page, exploitation extends to pre-authentication users. Technical details are tracked in the GitHub Vulnerability Issue #6.

Detection Methods for CVE-2026-71802

Indicators of Compromise

Announcement records in the REBUILD database containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs after decoding stored entities.
Outbound browser requests from dashboard, activity feed, or login page sessions to unfamiliar domains coinciding with announcement views.
Unexpected creation or modification of announcement content by administrator accounts outside normal change windows.

Detection Strategies

Query the announcements table for encoded payload markers such as <script, <img, onerror=, and onload= to catch stored content that would decode into executable markup.
Enable Content Security Policy (CSP) reporting to capture script-source violations generated by injected inline scripts on REBUILD pages.
Review web server and application logs for administrative announcement create/update requests and correlate with subsequent anomalous client-side traffic.

Monitoring Recommendations

Alert on administrative writes to the announcement endpoint from unusual source IP addresses or user agents.
Monitor browser telemetry from managed endpoints for script execution on the REBUILD login page, which should not normally run user-supplied script.
Track authentication and session anomalies for users who recently loaded pages hosting announcement previews.

How to Mitigate CVE-2026-71802

Immediate Actions Required

Remove or disable all existing announcements in REBUILD 4.4.3 until the preview component is patched.
Restrict the announcement authoring role to a minimal set of trusted administrators and enforce multi-factor authentication (MFA) on those accounts.
Change announcement visibility so that untrusted content does not render on the login page or other pre-authentication surfaces.
Audit announcement records for stored payloads and purge any entries containing script or event-handler markup.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-71802 at the time of publication. Track the upstream project and the GitHub Vulnerability Issue #6 for a fixed release. Any code fix should replace the html($(...).text()) pattern with a text-only sink such as text() on the target element, or perform strict allow-list HTML sanitization before assignment.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, blocking payload execution even if injection succeeds.
Apply a reverse-proxy or Web Application Firewall (WAF) rule that inspects announcement submission bodies and blocks HTML tag and event-handler patterns.
Patch the client-side preview locally by replacing the vulnerable jQuery chain with text() assignment to the preview element.

bash

# Example Content Security Policy header to mitigate stored XSS execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report