---
id: CVE-2026-73038
title: >-
  NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in
  the renderEmoji function that fails to escape tag.icon.url and tag.name
  attributes
summary: >-
  NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in
  the renderEmoji function that fails to escape tag.icon.url and tag.name
  attributes. Attackers can deliver malicious ActivityPub Create/Note objects
  with crafted…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-08-13'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73038'
references:
  - url: >-
      https://github.com/NodeBB/NodeBB/commit/c0d94a217edcafcdb9b3920a6e80935194bcb19e
    label: disclosure@vulncheck.com
  - url: 'https://github.com/NodeBB/NodeBB/issues/14601'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/NodeBB/NodeBB/releases/tag/v4.15.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nodebb-stored-xss-via-activitypub-emoji-tag-icon-url-and-tag-name
    label: disclosure@vulncheck.com
  - url: 'https://github.com/NodeBB/NodeBB/issues/14601'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00246
epssPercentile: 0.14152
ingestedAt: '2026-09-24T20:51:40.200Z'
---

## Overview

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.