CVE-2026-40230 — Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering

CVE-2026-40230

Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering PUBLISHED

Description (CNA)

Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor privileges can persist arbitrary HTML or JavaScript in the body field of a knowledge base Doc.This issue affects helpy: 2.8.0.

Affected (CNA)

Vendor / product	Versions
helpyio / helpy	affected 2.8.0

CWE

CWE-79

References

https://fluidattacks.com/es/advisories/prisioneros
https://github.com/helpyio/helpy

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.