CVE-2026-23630 Details
Description
Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0.
A stored Cross-Site Scripting (XSS) vulnerability has been identified in Docmost versions 0.3.0 prior to 0.23.2. The issue arises in the rendering of Mermaid diagrams, where attacker-controlled content is processed and injected into the DOM without proper sanitization. This vulnerability allows for the execution of arbitrary HTML and JavaScript in the context of the user viewing the page.
Users are advised to upgrade to Docmost version 0.24.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/docmost/docmost/commit/cb9f27da9a8b4940760e37e5238a1eb91e427daf | [email protected] | Patch |
| https://github.com/docmost/docmost/releases/tag/v0.24.0 | [email protected] | ProductRelease Notes |
| https://github.com/docmost/docmost/security/advisories/GHSA-r4hj-mc62-jmwj | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| docmost docmost | >= 0.3.0, < 0.24.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 17, 2026 | Initial Analysis | [email protected] |
| Jan 21, 2026 | New CVE Received | [email protected] |