Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/umputun/remark42

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2GoPublished

    Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

    CVE-2026-48788 · GHSA-4c8j-mgm4-qqvp

    Affected
    • Go github.com/umputun/remark42 >= 1.6.0, < 1.16.0
    Fixed in
    1.16.0· Vendor fix available
    Issue
    The remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42's own origin. The download path decides whether the fetched resource is an image by looking only at the Content-Type header the remote server claims — it never inspects the actual bytes. The serving path then derives the response Content-Type by sniffing those bytes with http.DetectContentType. An attacker hosts a URL that sets Content-Type to image/png but returns an HTML/JavaScript body: the download check sees image/png → accepts it; the serve path sniffs the body → emits Content-Type: text/html; the browser renders attacker HTML/JS as a document in remark42's origin. Details Downloader backend/app/rest/proxy/image.go — downloadImage(), lines 189-206: Send Content-Type: image/png and the check passes regardless of what the body actually contains. Server backend/app/rest/proxy/image.go — Handler(), line 131: backend/app/store/image/image.go — ImgContentType(), lines 242-249:…

    Recommended action: Upgrade to 1.16.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →