CVE-2024-57041: NodeBB Persistent XSS Vulnerability in User Profiles
Summary
CVE-2024-57041: NodeBB Cross-site scripting (XSS) vulnerability. Affects nodebb versions < 3.11.1. Fixed in 3.11.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NodeBB is a modern forum software built on Node.js, designed to provide a rich user experience with real-time notifications and a customizable interface. It allows users to create profiles, engage in discussions, and share content. However, a persistent cross-site scripting (XSS) vulnerability has been identified in version 3.11.0, which could allow attackers to inject malicious scripts into user profiles, potentially compromising user data and security.
Vulnerability Detail
The vulnerability arises from improper input validation in the 'about me' section of user profiles in NodeBB v3.11.0. This flaw allows remote attackers to store arbitrary JavaScript code, which is then executed in the context of other users' browsers when they view the affected profile. The implications of this vulnerability can be severe, as it may lead to session hijacking, data theft, or further exploitation of the application. The vulnerability is classified under CWE-79, indicating a cross-site scripting issue.
How To Fix
Latest published version: 1.4.0 as of 23 Oct 2026
npm install nodebb@1.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.1
This is the first release that contains the fix.
npm install nodebb@3.11.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the 'about me' section in user profiles until the update is applied. This can be done by modifying the configuration settings in NodeBB to restrict user input in that area.
Conclusion
The persistent XSS vulnerability in NodeBB v3.11.0 poses a significant risk to user security. It is crucial for users to update to version 3.11.1 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring ongoing protection.
See every vulnerability recorded for nodebb →
FAQ
The vulnerability is a persistent cross-site scripting (XSS) issue that allows attackers to inject malicious scripts into user profiles.
If you are using NodeBB version 3.11.0, your installation is vulnerable. Check your version using the command npm list nodebb.
The vulnerability can lead to session hijacking, data theft, and unauthorized actions performed on behalf of users.
Yes, tools like Vulert can monitor your application for open-source vulnerabilities using just the package-lock.json file.
You can find detailed information on the GitHub advisory database or by visiting the NodeBB community forums.
Related vulnerabilities
Recent vulnerabilities recorded for nodebb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
