WS-2026-0016

NodeBB before v4.14.0: stored XSS in the ActivityPub federation errors admin page - id, type, activityType and body of inbound AP objects rendered without escaping. Fixed in 4.14.0. One of eight Aikido-disclosed flaws; no CVE assigned...