https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 17:24:41 +0000 https://cve.radiocsirt.org/vuln/cve-2026-53427 <p><strong>Affected:</strong> leandrocp mdex, leandrocp mdex_native</p> <p>Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.</p> <p>When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence&#39;s highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line &lt;div&gt;. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as &#39;&#34;&gt;&lt;script&gt;alert(1)&lt;/script&gt;&#39; terminates the class attribute early and the markup that follows is emitted as live HTML.</p> <p>An attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.</p> <p>The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_ad…</p> <p><strong>Affected:</strong> leandrocp mdex, leandrocp mdex_native</p> <p>Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.</p> <p>When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence&#39;s highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line &lt;div&gt;. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as &#39;&#34;&gt;&lt;script&gt;alert(1)&lt;/script&gt;&#39; terminates the class attribute early and the markup that follows is emitted as live HTML.</p> <p>An attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.</p> <p>The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_ad…</p> https://cve.radiocsirt.org/vuln/cve-2026-53427