CVE-2018-8046: Sencha Ext JS Action Column getTip() unescapes data, enabling XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS rates it medium (6.1) with user interaction required, but the high EPSS score and the fact that standard escaping does not protect against it raise the practical risk.

What it is

The getTip() method of Action Columns in Sencha Ext JS 4 through 6 (before 6.6.0) un-escapes HTML-escaped data before rendering it as a tooltip. Because the framework provides no built-in XSS protection, developers who correctly escaped user-controlled data still end up with an injection point. This matters because it defeats the standard escaping defense and turns any tooltip fed with user data into a cross-site scripting vector.

Impact

An attacker can execute script in the context of a victim's browser session, allowing theft of session data, credential harvesting, or actions performed as the victim. The scope change in the CVSS vector reflects that the injected script can affect resources beyond the vulnerable component.

Attack surface

Reached over the network through a crafted tooltip value rendered by an Action Column; the CVSS vector shows no privileges required but user interaction required, meaning a victim must trigger or view the tooltip. No authentication is needed to deliver the payload, but the victim must interact with the affected UI element.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, though EPSS is high at 0.67 (99th percentile), indicating elevated predicted likelihood of exploitation activity. The reference tags are only release notes and a mailing list advisory, so no confirmed in-the-wild exploitation is documented here.

What to do

• Upgrade Sencha Ext JS to 6.6.0 or later, which contains the fix noted in the vendor release notes.
• If upgrade is not immediately possible, override or patch the getTip() method so it does not un-escape already-escaped data before rendering.
• Sanitize tooltip content server-side and avoid placing raw user-controlled data into Action Column tooltips.
• Apply a strict Content Security Policy to limit script execution if an injection occurs.

Detection

• Review application code and templates for Action Column tooltips populated with user-controlled data.
• Monitor web logs and client-side error reporting for script payloads in parameters that feed tooltip content.
• Search for anomalous DOM or script execution events tied to tooltip rendering in browser telemetry.
• Check deployed Ext JS versions against the 6.6.0 fixed baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.