CVE-2026-53758CWE-79cross-site-scripting

CVE-2026-53758

published September 4, 2026

CVSS
8.7
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including <script> tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization, resulting in stored XSS visible to all site visitors. At time of publication, there are no publicly known patches.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-04T22:17Z
References (2)
https://github.com/emlog/emlog/security/advisories/GHSA-35vc-2gv4-mw77 · [email protected]https://github.com/emlog/emlog/security/advisories/GHSA-35vc-2gv4-mw77 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 06 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 04 SEP 17:47Z
    Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized
    cvelistv5