CVE-2026-123094

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the servicelabel helper that marks unescaped OAuth service display names as htmlsafe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing...

EUVD-2026-117539

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the servicelabel helper that marks unescaped OAuth service display names as htmlsafe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing...

CVE-2026-123094

Huginn versions prior to 2026.11.05 are vulnerable to a stored cross-site scripting (XSS) flaw in the service_label helper. The root cause is the application marking unescaped OAuth service display names as html_safe. An authenticated attacker can exploit this by connecting an OAuth account with ...