Към съдържанието
Търсене

CVE-2026-53427: leandrocp mdex, XSS

2.3

CVSS 4.0

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, само при определена конфигурация или състояние на системата, без вход и след действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown. When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line <div>. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '"><script>alert(1)</script>' terminates the class attribute early and the markup that follows is emitted as live HTML. An attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required. The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched. This issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.

Засегнати продукти

  • leandrocp mdex: 0.11.3 преди 0.12.3
  • leandrocp mdex: 0d7ffc84ea742e1daf666426814e5bb6d0499433 преди 6ed94d905f97af188323f042698ae841c02293b4
  • leandrocp mdex_native: 0.1.0 преди 0.2.3
  • leandrocp mdex_native: 956528c5e31746253347029e810a969ab916fd27 преди 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3

Вид слабост

История

  • 29 юни 2026 Публикувано

Други уязвимости в leandrocp mdex

Първоизточници

CVE-2026-53427: leandrocp mdex, XSS | freedomonline.bg