EUVD-2026-86390

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute...

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Impact A Stored Cross-Site Scripting XSS vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value e.g., converting to script, the...

CVE-2026-61823

The code16 Sharp framework (a Laravel-based CMS/admin interface) is vulnerable to stored cross-site scripting (XSS) in versions prior to 9.22.5 . The root cause is that the rich-text editor's HTML sanitizer allows the srcdoc attribute on iframe elements. While the sanitizer HTML-encodes the inter...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-12295-UXXS-in-my-wasm

CVE-2026-12295 — 非about:srcdoc URI上のsrcdocデータ（Firefox UXSS） 概念実証：侵害されたコンテンツプロセスが、nsDocShellLoadState に任意の URI とともに SrcdocData を保持する PDocumentChannel ロードを偽造します。脆弱なビルドでは、攻撃者のHTMLが被害者のオリジン でドキュメントとして配信されます — 同一オリジン読み取り＋外部送信（UXSS）。 対象：Firefox 149.0a1 nightly @ 2fbc0748c4（脆弱、修正前）、macOS arm64。 Firefox...

CVE-2026-63671: Improper Neutralization of Input During Web Page Generation

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

Astra Linux – Vulnerability in Thunderbird

When receiving an HTML email that contained an iframesrcdoc attribute to define the inner HTML document, remote objects specified in the nested document—such as images or videos—were not blocked. Instead, the network was accessed, the objects were loaded, and displayed. This vulnerability affects...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the removeScriptElement plugin, which fails to strip SVG event attributes e.g. onclick, onload, javascript: and vbscript: scheme URLs, executable data: URLs, and srcdoc attributes inside foreignObject...

CVE-2026-82642

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

EUVD-2026-68218

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642

Readest is an open-source e-book reader built on Tauri . In versions prior to 0.11.16 , the EPUB HTML sanitizer (DOMPurify) in apps/readest-app/src/services/transformers/sanitizer.ts forbade only the [removed] tag. Because DOMPurify treats the srcdoc attribute on elements as an opaque string, a ...

PT-2026-83563

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBID TAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the conten...

Exploit for Improper Isolation or Compartmentalization in Mozilla Firefox

CVE-2026-12295 — srcdoc data on a non-about:srcdoc URI Firefo...

SUSE CVE-2026-40922

SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering incomplete fix for CVE-2026-33066 enabled the Lute HTML sanitizer, but the sanitizer does not block iframe tags, and its URL-prefix blocklist does not...

NPM: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

NPM: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

GHSA-P3RG-HRF9-W9GJ n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Impact The HTML preview renders execution output into an iframe srcdoc without sandbox, so a sanitizer bypass lets injected script run same-origin as the editor. When a victim opens the preview, it can call authenticated APIs with their session. An account with global:member privileges can exploi...

n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Impact The HTML preview renders execution output into an iframe srcdoc without sandbox, so a sanitizer bypass lets injected script run same-origin as the editor. When a victim opens the preview, it can call authenticated APIs with their session. An account with global:member privileges can exploi...