CVE-2026-20841

CVE-2026-20841 - Windows 메모장 RCE Windows 메모장의 마크다운 렌더러에서 발생하는 원격 코드 실행 취약점에 대한 PoC입니다. 마크다운 엔진이 URL 프로토콜을 제한하지 않아 클릭 가능한 링크를 통해 임의의 프로토콜 핸들러가 트리거될 수 있습니다. 면책 조항 1. 제가 발견한 것이 아닙니다. 공로는 MSRC 권고의 원본 연구자들에게 있습니다. 이는 PoC 재현입니다. 2. 실제보다 낮은 심각도입니다. 대부분의 경우 한 번 이상의 클릭이 필요합니다 제한 사항 참조. "메모장 RCE"라는 점이 너무...

CVE-2026-20841

CVE-2026-20841 - Windows 메모장 RCE Windows 메모장의 마크다운 렌더러에서 발생하는 원격 코드 실행 취약점에 대한 PoC입니다. 마크다운 엔진이 URL 프로토콜을 제한하지 않아, 클릭 가능한 링크를 통해 임의의 프로토콜 핸들러가 트리거될 수 있습니다. 면책 조항 1. 제가 발견한 것이 아닙니다. 공로는 MSRC 권고의 원본 연구자들에게 있습니다. 이는 PoC 재현입니다. 2. 실제보다 심각도가 낮습니다. 대부분의 경우 한 번 이상의 클릭이 필요합니다 제한 사항 참조. PoC 로컬 바이너리 실행...

GHSA-34PM-923J-7WF8 Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

Summary Kestra’s Markdown renderer supports a custom link ... syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can...

Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

Summary Kestra’s Markdown renderer supports a custom link ... syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can...

CVE-2026-19744

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

EUVD-2026-58109

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-19744

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-19744

CVE-2026-19744 details a stored Cross-site Scripting (XSS) vulnerability in the Markdown renderer of Pentestify (MaAlfer) prior to version 2.3.2. The issue arises when a Markdown link URL contains a double quote, which closes the anchor href and allows arbitrary JavaScript execution in the applic...

CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

PT-2026-71684

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-48910

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWik...

EUVD-2026-51183

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWik...

EUVD-2026-35496

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting XSS vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including tags—is processed and injecte...

CVE-2026-44264

Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1...

SUSE CVE-2026-44264

Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1...

GHSA-3V85-FQVH-7RXF Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

Summary The public RSS/Atom feed at /rss renders two attacker-controlled surfaces without HTML escaping. Tag names flow through fmt.AppendfrenderedContent, "%s", tag.Name at internal/service/common/common.go:120, and the Markdown renderer at internal/util/md/md.go does not set the html.SkipHTML...

CVE-2026-44264

Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1...

PYSEC-2026-2319

Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1...