CVE-2026-46492 Details
Description
md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including <script> tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.
A cross-site scripting (XSS) vulnerability has been identified in md-fileserver versions prior to 1.10.3. The issue arises in the application's Markdown rendering process, where user-supplied content is processed without proper sanitization. This allows embedded raw HTML, including <script> tags, to be injected and executed as JavaScript in the context of the affected domain. The vulnerability can be exploited by crafting malicious Markdown that is then viewed or previewed, triggering the execution of the embedded scripts.
Users can update to md-fileserver version 1.10.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/commenthol/md-fileserver/security/advisories/GHSA-32q2-hhr5-6qvv | CISA-ADP | Vendor AdvisoryExploit |
| https://github.com/commenthol/md-fileserver/releases/tag/v1.10.3 | [email protected] | Release Notes |
| https://github.com/commenthol/md-fileserver/security/advisories/GHSA-32q2-hhr5-6qvv | [email protected] | Vendor AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | [email protected] |
| CWE-87 | Improper Neutralization of Alternate XSS Syntax | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| commenthol md-fileserver | < 1.10.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | New CVE Received | [email protected] |