CVE-2026-42455

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In versions 2.14.0 and prior, the archive upload endpoint (POST /api/v1/archives/[linkId]?format=4) accepts HTML files (text/html) without sanitizing JavaScript content. When the archive is later accessed via GET /api/v1/archives/[linkId]?format=4, the HTML is served with Content-Type: text/html from the Linkwarden origin, without any Content-Security-Policy header. This allows arbitrary JavaScript execution in the context of the authenticated Linkwarden sessio. At time of publication, there are no publicly available patches.

• CWE-79

• https://github.com/linkwarden/linkwarden/security/advisories/GHSA-fjvg-mch3-j3vg
• https://github.com/linkwarden/linkwarden/security/advisories/GHSA-fjvg-mch3-j3vg

Published

May 9, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4245The Post Duplicator plugin for WordPress is vulnerable to au…4.3
• CVE-2026-42450OpenColorIO is a color management framework for visual effec…8.4
• CVE-2026-42451Grimmory is a self-hosted digital library. Prior to version …6.3
• CVE-2026-42452Termix is a web-based server management platform with SSH te…8.1
• CVE-2026-42453Termix is a web-based server management platform with SSH te…8.7
• CVE-2026-42454Termix is a web-based server management platform with SSH te…9.9
• CVE-2026-42456AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-42457vCluster Platform provides a Kubernetes platform for managin…9
• CVE-2026-42458Magento Long Term Support (LTS) is an unofficial, community-…5.3
• CVE-2026-42459free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-4246The ElementsKit Pro plugin for WordPress is vulnerable to St…6.1
• CVE-2026-42461Arcane is an interface for managing Docker containers, image…7.5