CVE-2026-120500

An Otter Wiki version prior to 2.26.2 is vulnerable to a stored cross-site scripting (XSS) flaw in the OtterwikiMdRenderer.block_code component. The root cause is that HTML placed inside a math fenced code block is rendered without proper escaping. Attackers with page editing permissions—which ca...