CVE-2026-46492
High · 7.2CVSS
7.2
EPSS
0.3%
Published
Jun 9, 2026
CISA due date
—
The record
md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including <script> tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | md-fileserver | 0 | 1.10.3 |
Related vulnerabilities
- GHSA-32q2-hhr5-6qvv md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) Same vulnerability
- CVE-2026-52773 YesWiki is a wiki system written in PHP. CWE-80
- CVE-2026-52774 YesWiki is a wiki system written in PHP. CWE-80
- CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a… CWE-80
- CVE-2026-82838 The default docker image shipped for Venueless did not properly ensure that uploaded SVG… CWE-80
- CVE-2026-55696 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. CWE-80
- CVE-2026-5218 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)… CWE-80
- CVE-2026-20232 A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE)… CWE-80