GHSA-32q2-hhr5-6qvv
High · 7.2CVSS
7.2
EPSS
—
Published
May 21, 2026
CISA due date
—
The record
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | md-fileserver | 0 | 1.10.3 |
Related vulnerabilities
- CVE-2026-46492 md-fileserver allows for local viewing of markdown files in a browser. Same vulnerability
- CVE-2026-52773 YesWiki is a wiki system written in PHP. CWE-80
- CVE-2026-52774 YesWiki is a wiki system written in PHP. CWE-80
- CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a… CWE-80
- CVE-2026-82838 The default docker image shipped for Venueless did not properly ensure that uploaded SVG… CWE-80
- CVE-2026-55696 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. CWE-80
- CVE-2026-5218 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)… CWE-80
- CVE-2026-20232 A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE)… CWE-80