CVE-2026-23630CWE-116CWE-79

Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering

Medium · published January 21, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00292 · 20.6th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-21T22:51Z
EPSS history
Timeline
  • 21 JAN 22:51Z
    Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering
    cvelistv5