CVE-2026-46492CWE-80CWE-87

CVE-2026-46492

High · published June 9, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including <script> tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.8th percentile
Weaknesses
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS); CWE-87 · Improper Neutralization of Alternate XSS Syntax
Published
2026-06-09T21:17Z
Affected products (1)
ProductVersionsFixed in
commenthol/md-fileserver< 1.10.31.10.3
References (3)
https://github.com/commenthol/md-fileserver/releases/tag/v1.10.3 · [email protected]https://github.com/commenthol/md-fileserver/security/advisories/GHSA-32q2-hhr5-6qvv · [email protected]https://github.com/commenthol/md-fileserver/security/advisories/GHSA-32q2-hhr5-6qvv · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 JUN 16:09Z
    md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
    cvelistv5