CVE-2026-24127

Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.

• CWE-79
• CWE-116
• CWE-79

• https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88cPatch
• https://github.com/typemill/typemill/releases/tag/v2.19.2Product, Release Notes
• https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wrExploit, Third Party Advisory

Published

Jan 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24120vm2 is an open source vm/sandbox for Node.js. Prior to versi…9.8
• CVE-2026-24122Cosign provides code signing and transparency for containers…3.7
• CVE-2026-24123BentoML is a Python library for building online serving syst…6.5
• CVE-2026-24124Dragonfly is an open source P2P-based file distribution and …9.8
• CVE-2026-24125Tina is a headless content management system. Prior to 2.1.2…6.3
• CVE-2026-24126Weblate is a web based localization tool. Prior to 5.16.0, t…9.1
• CVE-2026-24128XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2026-24129Runtipi is a Docker-based, personal homeserver orchestrator …8.8
• CVE-2026-2413The Ally – Web Accessibility & Usability plugin for WordPres…7.5
• CVE-2026-24130Moonraker is a Python web server providing API access to Kli…5.3
• CVE-2026-24131pnpm is a package manager. Prior to version 10.28.2, when pn…5.5
• CVE-2026-24132Orval generates type-safe JS clients (TypeScript) from any v…9.8