CVE-2026-72743: SQLBot Stored XSS Vulnerability

CVE-2026-72743 Overview

CVE-2026-72743 is a stored Cross-Site Scripting (XSS) vulnerability in SQLBot through version 1.10.0. The flaw resides in the SQText dashboard component, which renders TinyMCE editor output through Vue's v-html directive without sanitization. Attackers with permission to modify dashboard text widget content can inject arbitrary HTML and JavaScript. The injected payload executes in the browsers of all users who subsequently view the affected dashboard. The issue is fixed in commit c3f40a5, which replaces v-html with v-dompurify-html to sanitize rendered content. This weakness is classified under CWE-79.

Critical Impact
Authenticated users with dashboard edit rights can persist malicious scripts that execute for every viewer, enabling session theft, credential harvesting, and unauthorized actions in the SQLBot application context.

Affected Products

SQLBot through version 1.10.0
SQLBot SQText dashboard component (frontend/src/views/dashboard/components/sq-text/index.vue)
Fixed in commit c3f40a5c05a53253b2924765b02b83f6a819948f (PR #1309)

Discovery Timeline

2026-08-10 - CVE-2026-72743 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72743

Vulnerability Analysis

SQLBot integrates the TinyMCE rich text editor to allow dashboard authors to create text widgets. The rendered output was passed directly to Vue's v-html directive, which inserts raw HTML into the DOM without escaping or sanitization. Because TinyMCE content is user-controlled and stored server-side, any HTML or JavaScript embedded in a widget persists across sessions and runs for every user rendering the dashboard.

Exploitation requires the attacker to hold an authenticated role capable of editing dashboard text widgets. Once the payload is saved, no further attacker action is needed. Every viewer who loads the dashboard executes the payload under their own session, exposing cookies, tokens, and application state.

Root Cause

The root cause is direct binding of untrusted, editor-authored content to v-html in the SQLBot Vue frontend. Vue's v-html directive does not sanitize input and treats the bound value as trusted HTML. Combined with TinyMCE output that can contain <script>, event handlers such as onerror, or <iframe> elements, this creates a stored XSS sink [CWE-79].

Attack Vector

An authenticated attacker with dashboard edit privileges opens a text widget, inserts an HTML payload through the TinyMCE editor or a crafted API request, and saves the widget. When any user later loads the dashboard, the SQText component renders the payload via v-html, executing the attacker's JavaScript in the victim's browser under the SQLBot origin.

text

       @keyup.stop
       @mousedown.stop
       @dblclick.stop="setEdit"
-      v-html="configItem.propValue"
+      v-dompurify-html="configItem.propValue"
     ></div>
     <editor
       :id="tinymceId"

Source: GitHub commit c3f40a5 — the patch replaces the unsafe v-html binding with v-dompurify-html, which sanitizes rendered HTML through DOMPurify before insertion.

Detection Methods for CVE-2026-72743

Indicators of Compromise

Dashboard text widgets containing <script> tags, inline event handlers (onerror, onload, onclick), or <iframe> elements in their stored propValue.
Unexpected outbound HTTP requests from user browsers to attacker-controlled domains immediately after loading a SQLBot dashboard.
Session token or cookie exfiltration attempts originating from the SQLBot frontend origin.
Anomalous edits to dashboard text components by accounts that do not typically author dashboards.

Detection Strategies

Scan the SQLBot dashboard datastore for stored widget content matching XSS payload signatures such as javascript:, <script, or on[a-z]+= attributes.
Monitor SQLBot audit logs for SQText widget updates and correlate with subsequent viewer sessions.
Deploy Content Security Policy (CSP) violation reporting to surface inline script executions in the SQLBot origin.

Monitoring Recommendations

Alert on dashboard save events that introduce HTML tags with script-capable attributes.
Track version strings served by the SQLBot frontend to confirm every instance is upgraded past commit c3f40a5.
Review browser telemetry for suspicious DOM modifications or third-party script loads on SQLBot dashboard routes.

How to Mitigate CVE-2026-72743

Immediate Actions Required

Upgrade SQLBot to the build that includes commit c3f40a5c05a53253b2924765b02b83f6a819948f or later.
Audit all existing dashboard text widgets for stored HTML or JavaScript payloads and purge any suspicious content.
Restrict dashboard edit permissions to trusted users until the patch is applied.
Rotate session tokens and credentials for users who accessed potentially tainted dashboards.

Patch Information

The fix is delivered in pull request #1309 via commit c3f40a5. It replaces v-html with v-dompurify-html in frontend/src/views/dashboard/components/sq-text/index.vue, sanitizing TinyMCE output through DOMPurify. See the VulnCheck advisory and GitHub issue #1308 for background.

Workarounds

Temporarily disable or hide the SQText dashboard component if a patch cannot be applied immediately.
Enforce a strict Content Security Policy that blocks inline scripts and untrusted script sources on SQLBot pages.
Reduce the set of accounts with dashboard edit rights to the minimum required, treating widget editing as a privileged action until the upgrade is complete.

bash

# Verify the SQLBot deployment includes the fix commit
git -C /path/to/SQLBot log --oneline | grep c3f40a5

# Confirm the patched directive is in use
grep -R "v-dompurify-html" frontend/src/views/dashboard/components/sq-text/