CVE-2026-116229

ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting

State: Published
Severity: 5.1 Medium
Published: Oct 26, 2026
Updated: Oct 28, 2026
Reserved: Oct 25, 2026

Description

A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process IPC Bridge. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 11.4.32 is recommended to address this issue. Patch name: def118fdf36f8f3b615966893a132dd81d9cc3dc. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
FFXIV Teamcraftffxiv-teamcraft	11.4.0Affected 11.4.1Affected 11.4.2Affected 11.4.3Affected 11.4.4Affected 11.4.5Affected 11.4.6Affected 11.4.7Affected 11.4.8Affected 11.4.9Affected 11.4.10Affected 11.4.11Affected 11.4.12Affected 11.4.13Affected 11.4.14Affected 11.4.15Affected 11.4.16Affected 11.4.17Affected 11.4.18Affected 11.4.19Affected 11.4.20Affected 11.4.21Affected 11.4.22Affected 11.4.23Affected 11.4.24Affected and 8 more versions

Product

Versions

FFXIV Teamcraftffxiv-teamcraft

11.4.0Affected
11.4.1Affected
11.4.2Affected
11.4.3Affected
11.4.4Affected
11.4.5Affected
11.4.6Affected
11.4.7Affected
11.4.8Affected
11.4.9Affected
11.4.10Affected
11.4.11Affected
11.4.12Affected
11.4.13Affected
11.4.14Affected
11.4.15Affected
11.4.16Affected
11.4.17Affected
11.4.18Affected
11.4.19Affected
11.4.20Affected
11.4.21Affected
11.4.22Affected
11.4.23Affected
11.4.24Affected
and 8 more versions

References

VDB-426278 | ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scriptingvdb-entrytechnical-description
VDB-426278 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-116229 | CVE Analysis and Reportthird-party-advisory
Submit #1007305 | https://github.com/ffxiv-teamcraft ffxiv-teamcraft 11.4.31 Local Sensitive Logic Leading to webpage jumpingthird-party-advisory
https://drive.google.com/drive/folders/1pxitXRLnnnl9GPnyN83ILAgWHWve3ezX?usp=sharingexploit
https://github.com/ffxiv-teamcraft/ffxiv-teamcraft/commit/def118fdf36f8f3b615966893a132dd81d9cc3dcpatch
https://github.com/ffxiv-teamcraft/ffxiv-teamcraft/releases/tag/v11.4.32patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.