Stirling-PDF SSRF via Markdown

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

Stirling-PDF < 1.1.0 - Server-Side Request Forgery

Stirling-PDF 1.1.0 contains a server side request forgery caused by bypassing the sanitizer in the /api/v1/convert/html/pdf endpoint when processing HTML to PDF conversion, letting attackers perform SSRF, exploit requires local access. id: CVE-2025-55150 info: name: Stirling-PDF 1.1.0 - Server-Si...

CVE-2026-47423-dompurify-xss-detector

DOMPurify 재클론 로직 결함을 통해 완전한 새니타이저 우회에 취약한 DOMPurify의 프로덕션 배포를 탐지합니다. 이 도구는 쉽게 제거되는 소스 주석이나 버전 변수에 의존하지 않고, 축소된 프로덕션 JavaScript 번들에서 패치되지 않은 허용 태그 레이아웃을 식별하기 위해 로직 핑거프린팅을 수행합니다. 취약점 요약 DOMPurify 버전 3.4.4까지는 요소가 기본적으로 허용되었습니다. 이로 인해 Chromium/WebKit 브라우저가 DOMPurify의 새니타이즈 패스가 이미 실행된 후에 서브트리를 다시 새로고침...

CVE-2026-85061 MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous...

CVE-2026-28134

CVE-2026-28134 악용 보고서 JetEngine = 3.7.2 — Twig SSTI를 통한 인증된 Contributor+ 원격 코드 실행 날짜: 2026년 3월 11일 CVSS 점수: 8.8 높음 CVSS 벡터: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 영향을 받는 플러그인: JetEngine = 3.7.2 플러그인 슬러그: jet-engine CVE: CVE-2026-28134 상태: 비공개 테스트된 WordPress 버전: 최신 요약 CVE-2026-28134는 JetEngi...

CVE-2026-65591

CVE-2026-65591 취약한 소프트웨어 이름 및 영향을 받는 버전 1.123.64 이전의 n8n 버전 2.29.8 이전의 n8n 버전 2.30.1 이전의 n8n 버전 설명 레거시 표현식 평가기의 computed-member 핸들러에 샌니타이저 우회sanitizer bypass 취약점이 존재합니다. 워크플로를 생성하거나 수정할 수 있는 권한이 있는 인증된 사용자는 악성 표현식을 제작하여 샌니타이저를 우회할 수 있으며, 이를 통해 n8n 프로세스의 권한으로 호스트 수준 코드 실행이 가능합니다. 레거시 표현식 엔진은 영향을 받...

EUVD-2026-68218

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642

Readest is an open-source e-book reader built on Tauri . In versions prior to 0.11.16 , the EPUB HTML sanitizer (DOMPurify) in apps/readest-app/src/services/transformers/sanitizer.ts forbade only the [removed] tag. Because DOMPurify treats the srcdoc attribute on elements as an opaque string, a ...

Astra Linux – Vulnerability in Firefox

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox versions earlier than 86...

CVE-2026-8445

justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting whe...

CVE-2026-74793

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

EUVD-2026-64659

justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting whe...

CVE-2026-8445 justhtml before 1.12.0 Sanitizer Bypass via Markdown

justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting whe...

CVE-2026-8445

justhtml (a Python HTML parsing library) versions &lt;= 1.11.0 are vulnerable to a sanitizer bypass via its to_markdown() method. The root cause is insufficient escaping of HTML-significant characters (angle brackets ) in text nodes during Markdown conversion. While a small set of Markdown metach...

CVE-2026-8445 justhtml before 1.12.0 Sanitizer Bypass via Markdown

justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting whe...

EUVD-2026-64656

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

CVE-2026-74793

justhtml versions before 3.11.0 are affected by a cross-site scripting (XSS) vulnerability in the default sanitizer. The root cause is that event handler removal is bypassed in selectedcontent projections : an attacker can inject SVG or MathML elements carrying event handlers, which are then clon...

CVE-2026-74793 justhtml before 3.11.0 XSS via selectedcontent projection

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

PT-2026-79776

justhtml versions are preserved, so untrusted input that is safe in to html — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting wh...

CVE-2026-61607 Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...