CVE-2026-23630

Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0.

• CWE-79
• CWE-116
• CWE-79

• https://github.com/docmost/docmost/commit/cb9f27da9a8b4940760e37e5238a1eb91e427dafPatch
• https://github.com/docmost/docmost/releases/tag/v0.24.0Product, Release Notes
• https://github.com/docmost/docmost/security/advisories/GHSA-r4hj-mc62-jmwjExploit, Vendor Advisory

Published

Jan 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23623Collabora Online is a collaborative online office suite base…5.3
• CVE-2026-23624GLPI is a free asset and IT management software package. In …6.5
• CVE-2026-23625OpenProject is an open-source, web-based project management …5.4
• CVE-2026-23626Kimai is a web-based multi-user time-tracking application. P…6.8
• CVE-2026-23627OpenEMR is a free and open source electronic health records …8.8
• CVE-2026-2363The WP-Members Membership Plugin plugin for WordPress is vul…6.5
• CVE-2026-23631Redis is an in-memory data structure store. In all versions …8.1
• CVE-2026-23632Gogs is an open source self-hosted Git service. In version 0…6.5
• CVE-2026-23633Gogs is an open source self-hosted Git service. In version 0…6.5
• CVE-2026-23634Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr de…4.3
• CVE-2026-23635Kiteworks is a private data network (PDN). In Kiteworks Secu…6.5
• CVE-2026-23636Kiteworks is a private data network (PDN). In Kiteworks Secu…7.2