Finding eight high-severity vulnerabilities in NodeBB in six hours

What it is

A whitebox security assessment of NodeBB (the NodeJS forum software) run by Aikido's AI pentesting agent, yielding eight high-severity vulnerabilities exploitable on default instances, all fixed in 4.14.0 (fixes landed early July). The summary covers the two Federation XSS flaws; the value the summary omits is the third, broadest issue and the fix references.

What the summary doesn't carry

• A template injection affecting practically every input on NodeBB. The post names this as a distinct issue beyond the two XSS and describes it as hitting nearly all input surfaces — potentially the highest-blast-radius finding of the eight, and not mentioned in the existing summary. (The page text is truncated before the full mechanism.)
• Multiple authorization bypasses used to "hijack and read various data that shouldn't be public" — the summary lists these only in passing.
• The root cause pattern behind the XSS class: NodeBB disables Benchpress auto-escaping (__escape: identity) and relies on developers manually escaping each variable — so any missed spot is a live sink. This is a systemic design decision, not a one-off bug.
• The first Federation XSS fix commit is 4c4bf76, which escapes data from federated sources.

Preconditions / Affected

NodeBB prior to 4.14.0, default configuration. The two Federation XSS flaws require the attacker to stand up a custom ActivityPub/webfinger server; the victim then only needs to search for or visit https://nodebb.local/user/xss@attacker.tld. The Federation Errors XSS can be stored by an unauthenticated attacker and fires later against an admin viewing the log.

What to do

• Upgrade to 4.14.0 or later. This is the only remediation the page offers.
• If running Aikido, it will automatically flag vulnerable instances.
• Given the escaping model, treat any remaining custom templates/plugins as suspect: NodeBB does not auto-escape, so unescaped variables in .tpl files are exploitable.

Caveats

The fetched page is truncated mid-sentence during the second XSS and never reaches the template injection or authorization-bypass details — so the most consequential finding (the template injection) is asserted but not explained here. The eight findings come from an autonomous AI agent; the post is a vendor writeup of its own product's output, and only the two XSS are described in depth.