High, CVSS 7.2npmAmendedPublished
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
CVE-2026-46492 · GHSA-32q2-hhr5-6qvv
- Affected
- npm md-fileserver < 1.10.3
- Fixed in
- 1.10.3· Vendor fix available
- Issue
- A cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including <script tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. Details An attacker can craft malicious Markdown content containing <script tags or event handlers (e.g., <img onerror=...). When this Markdown is viewed or previewed, the embedded JavaScript executes in the victim’s browser. Vulnerable Components config.js → markdownIt: { html: true } (Lines 26–30) The Markdown renderer is explicitly configured to allow raw HTML. lib/markd.js (Lines 33–58) Renders Markdown content without sanitizing HTML, allowing unsafe tags and attributes to remain in the output. lib/pages/template.html The rendered Markdown is injected into the HTML template using <%= markdown % without sanitization or output encoding. PoC…
Recommended action: Upgrade to 1.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.