Eight high-severity vulnerabilities have been discovered in NodeBB, a popular Node.js-based forum platform, exposing millions of users to risks including private message leaks, stored cross-site scripting (XSS), and full forum compromise.
The issues affect all NodeBB versions prior to 4.14.0 and were uncovered during an AI-assisted whitebox penetration test conducted by Aikido.
The findings reveal how modern AI-driven pentesting can rapidly identify complex, chained vulnerabilities that would typically take human researchers significantly longer to uncover.
In this case, multiple flaws were exploitable on default NodeBB installations, significantly increasing the risk to unpatched deployments.
Eight NodeBB Vulnerabilities
At the core of the disclosure are three distinct XSS vulnerabilities. One of the most critical issues stems from improper sanitization of user-controlled data in federated profiles. Attackers could set up a malicious federation server and inject a crafted payload into the profile image URL field.
Because NodeBB failed to escape this input when rendering HTML meta tags, attackers could break out of the attribute context and execute arbitrary JavaScript in a victim’s browser.
<meta> tag to execute JavaScript (source : Aikido )A second XSS flaw impacts the administrator panel via federation error logs. By sending specially crafted ActivityPub messages with mismatched origins, attackers could trigger error entries containing malicious HTML.
Since NodeBB failed to escape these values in the admin interface, simply viewing the error logs would execute attacker-controlled scripts, effectively allowing full administrative takeover.
A third vulnerability involves template and translation processing. NodeBB renders templates before applying translations, allowing attackers to inject translation syntax into user-controlled inputs.
This design flaw enables manipulation of HTML attributes and the execution of JavaScript via crafted links, making it possible to deliver phishing-style payloads or trigger client-side code execution.
Beyond XSS, researchers identified multiple authorization bypass vulnerabilities. One critical flaw allows attackers to impersonate any user via improperly validated ActivityPub signatures.
Because signature verification was only enforced for POST requests, attackers could send forged GET requests to access private messages using arbitrary user IDs. By iterating through message identifiers, threat actors could systematically extract private conversations.
Another vulnerability allows unauthorized access to restricted admin pages by abusing the custom homepage feature. By setting the homepage to an admin route, attackers could bypass privilege checks and access sensitive data such as error logs and user exports.
Additional issues include a mass assignment flaw that enables attackers to overwrite existing posts by manipulating internal post identifiers, and an information disclosure bug that exposes private category content via an unprotected ActivityPub endpoint.
Aikido researchers also demonstrated a logic flaw in the upvote system, allowing attackers to artificially inflate post popularity by submitting forged ActivityPub “Like” activities without proper identity verification.
All vulnerabilities were responsibly disclosed and patched in early July 2026. NodeBB version 4.14.0 introduces comprehensive fixes, including improved input sanitization, stricter authorization checks, and a redesigned translation handling mechanism.
Security experts strongly recommend that administrators immediately upgrade to the latest version. Tools like Aikido can automatically detect vulnerable instances, helping organizations identify exposure quickly.
The research highlights a broader security concern around federated protocols like ActivityPub, where multiple interaction paths can introduce inconsistent security controls.
It also underscores the growing role of AI in offensive security, where automated agents can scale vulnerability discovery far beyond traditional methods.
