4789 matches found
Stirling-PDF SSRF via Markdown
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...
CVE-2026-66921
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...
CVE-2026-66921
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...
CVE-2026-66921 Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...
EUVD-2026-49844
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...
CVE-2026-66921 Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...
CVE-2026-59922
A flaw was found in Mistune, a Python Markdown parser. A remote attacker could exploit this vulnerability by providing specially crafted input containing specific marker pairs tilde, equals-sign, or caret. This crafted input causes the parser to perform quadratic work, leading to excessive CPU...
CVE-2026-58402
A flaw was found in Hugo, a static site generator. The default code-block renderer failed to properly escape Markdown code-fence language or info-strings. This vulnerability allows an attacker to inject malicious script elements into web pages, leading to Cross-site Scripting XSS. Successful...
CVE-2026-59924
A flaw was found in Mistune, a Python Markdown parser. The Include.parse function does not properly verify user-supplied include paths, allowing an attacker to craft paths that can access files outside the intended markdown directory. This can lead to information disclosure when markdown files ar...
CVE-2026-17496
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...
CVE-2026-17496 NoteGen chat preview XSS via unsanitized AI/skill HTML rendering
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...
CVE-2026-17496
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...
EUVD-2026-49055
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...
CVE-2026-57531 Milkdown < 7.21.3 DOM XSS via innerHTML Assignment
Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...
CVE-2026-57530
Milkdown (versions
GO-2026-5208 Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown
Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown...
PT-2026-64410
Name of the Vulnerable Software and Affected Versions Milkdown versions prior to 7.21.3 Description A DOM cross-site scripting issue exists in the @milkdown/plugin-emoji package. Unauthenticated attackers can execute arbitrary JavaScript in the host application origin by tricking a victim into...
EUVD-2026-42337
Mistune: Arbitrary File Read via Include directive path traversal...
GHSA-R4RV-85JG-W4MF Mistune: Arbitrary File Read via Include directive path traversal
Summary A path traversal issue exists in mistune's Include directive when markdown files are processed using md.read. A crafted include path can cause files outside the intended markdown directory to be accessed. Details The issue occurs in the Include.parse method where user-supplied paths are...