CVE-2024-36109

CoCalc is web-based software that enables collaboration in research, teaching, and scientific publishing. In affected versions the markdown parser allows `<script>` tags to be included which execute when published. This issue has been addressed in commit `419862a9c9879c`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79

• https://github.com/sagemathinc/cocalc/commit/419862a9c9879c
• https://github.com/sagemathinc/cocalc/security/advisories/GHSA-8w44-hggw-p5rf
• https://github.com/sagemathinc/cocalc/commit/419862a9c9879c
• https://github.com/sagemathinc/cocalc/security/advisories/GHSA-8w44-hggw-p5rf

Published

May 28, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36103OS command injection vulnerability in WRC-X5400GS-B v1.0.10 …6.8
• CVE-2024-36104Improper Limitation of a Pathname to a Restricted Directory …9.1
• CVE-2024-36105dbt enables data analysts and engineers to transform their d…5.3
• CVE-2024-36106Argo CD is a declarative, GitOps continuous delivery tool fo…4.3
• CVE-2024-36107MinIO is a High Performance Object Storage released under GN…5.3
• CVE-2024-36108casgate is an Open Source Identity and Access Management sys…9.8
• CVE-2024-3611The Toolbar Extras for Elementor & More – WordPress Admin Ba…6.4
• CVE-2024-36110ansibleguy-webui is an open source WebUI for using Ansible. …8.2
• CVE-2024-36111KubePi is a K8s panel. Starting in version 1.6.3 and prior t…6.3
• CVE-2024-36112Nautobot is a Network Source of Truth and Network Automation…6.5
• CVE-2024-36113Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2024-36114Aircompressor is a library with ports of the Snappy, LZO, LZ…8.6