CVE-2026-80426: FiftyOne Dataset Field XSS Vulnerability

CVE-2026-80426 Overview

FiftyOne, an open-source dataset management tool from Voxel51, contains a stored cross-site scripting (XSS) vulnerability [CWE-79] in versions prior to 1.21.0. The sidebar field-information component passes a dataset field's description string directly to React's dangerouslySetInnerHTML without sanitization or escaping. Because descriptions persist in the dataset schema, they travel with exported and published datasets. A user who opens a third-party dataset and hovers a field triggers execution of attacker-controlled markup within the FiftyOne application origin.

Critical Impact
Injected JavaScript executes in the FiftyOne origin and can reach the unauthenticated media route, allowing arbitrary local file reads and access to dataset and operator endpoints as the viewing user.

Affected Products

FiftyOne versions prior to 1.21.0
FiftyOne open-source server (unauthenticated media route)
FiftyOne v1.20.1 confirmed vulnerable via app/packages/core/src/components/FieldLabelAndInfo/index.tsx

Discovery Timeline

2026-08-26 - CVE-2026-80426 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80426

Vulnerability Analysis

The vulnerability resides in the sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx. The component renders a field's description property using React's dangerouslySetInnerHTML, which injects the string as raw HTML into the DOM. Neighboring info values in the same component render as React children and are automatically escaped, making the description path the sole unsanitized sink.

Field descriptions are free-form strings stored in the dataset schema. They persist in the underlying database and are serialized when a dataset is exported, published, or shared. This turns the field into a stored XSS vector that follows the dataset artifact.

Execution occurs in the FiftyOne web application's origin, which is shared with the FiftyOne server. In the open-source distribution, the server's media route accepts a caller-supplied absolute path and returns file contents without authentication. Injected script can therefore read arbitrary local files and issue authenticated requests to dataset and operator endpoints as the viewing user.

Root Cause

The root cause is improper neutralization of input during web page generation. React's dangerouslySetInnerHTML bypasses the framework's built-in escaping. No layer between MongoDB storage and DOM rendering escapes or sanitizes the description string.

Attack Vector

An attacker crafts a dataset containing a field whose description includes malicious HTML or a <script>-equivalent payload. The attacker distributes the dataset through public repositories, dataset marketplaces, or direct transfer. When a victim loads the dataset in FiftyOne and hovers the affected field in the sidebar, the payload executes. See the VulnCheck Advisory for FiftyOne and the GitHub Component Code File for technical details.

Detection Methods for CVE-2026-80426

Indicators of Compromise

Dataset schema entries where field description values contain HTML tags, <script> markers, event handlers such as onerror= or onload=, or javascript: URIs.
Outbound requests from FiftyOne user browsers to the local server's media route referencing sensitive absolute paths such as /etc/passwd, SSH keys, or cloud credential files.
Unexpected calls to FiftyOne operator or dataset REST endpoints originating from the browser context shortly after a dataset is loaded.

Detection Strategies

Scan imported datasets for HTML markup in field description properties before opening them in the FiftyOne App.
Enable browser Content Security Policy reporting in front of FiftyOne deployments to surface inline script execution attempts.
Correlate media route access logs with concurrent user sessions to detect anomalous local file reads triggered by rendered pages.

Monitoring Recommendations

Log all requests to the FiftyOne media endpoint and alert on absolute paths outside the expected dataset media directories.
Monitor FiftyOne server versions across the environment and flag any host running a release earlier than 1.21.0.
Audit dataset schemas on ingest with automated tooling that rejects descriptions containing HTML control characters.

How to Mitigate CVE-2026-80426

Immediate Actions Required

Upgrade FiftyOne to version 1.21.0 or later, which contains the fix delivered in GitHub Pull Request #8117.
Do not open FiftyOne datasets received from untrusted third parties on any host still running a vulnerable version.
Restrict network exposure of the open-source FiftyOne server so its unauthenticated media route is not reachable from untrusted networks.

Patch Information

Voxel51 addressed the issue in FiftyOne 1.21.0 by sanitizing the field description before rendering. Refer to the GitHub Release v1.21.0 notes and the merged fix in GitHub Pull Request #8117 for implementation details.

Workarounds

Sanitize existing datasets by stripping HTML from all field description values in the MongoDB backing store before rendering them in the App.
Run the FiftyOne server bound to localhost only and place authenticated proxy in front of any remote access to limit exposure of the media route.
Review shared or imported datasets in a disposable environment isolated from sensitive files and credentials until the upgrade is applied.

bash

# Configuration example
pip install --upgrade "fiftyone>=1.21.0"
fiftyone --version