CVE-2026-40230

MediumCVSS 5.4

Published: 29/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor privileges can persist arbitrary HTML or JavaScript in the body field of a knowledge base Doc. This issue affects helpy: 2.8.0.

Risk Assessment

An attacker can execute arbitrary JavaScript in the browsers of users viewing the knowledge base, potentially leading to session theft or other actions. Editor privileges are required.

Recommendation

Update Helpy to a patched version or implement input sanitization for the body field of documents. Restrict editor privileges to trusted individuals.

Other vulnerabilities in Helpy

CVE-2026-40229Medium
Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML notification emails sent to other users. This issue affects helpy: 2.8.0.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS