CVE-2026-46492

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including <script> tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.

• CWE-80
• CWE-87

• https://github.com/commenthol/md-fileserver/releases/tag/v1.10.3Release Notes
• https://github.com/commenthol/md-fileserver/security/advisories/GHSA-32q2-hhr5-6qvvVendor Advisory, Exploit
• https://github.com/commenthol/md-fileserver/security/advisories/GHSA-32q2-hhr5-6qvvVendor Advisory, Exploit

Published

Jun 9, 2026

Last Modified

Aug 12, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46485Dashy is a self-hostable personal dashboard. Prior to 4.0.8,…8.2
• CVE-2026-46486MVT (Mobile Verification Toolkit) helps with conducting fore…5.3
• CVE-2026-46489SolidInvoice is an open-source invoicing platform. Prior to …8.1
• CVE-2026-4649Apache Artemis before version 2.52.0 is affected by an authe…5.3
• CVE-2026-46490samlify is a Node.js library for SAML single sign-on. Prior …8.8
• CVE-2026-46491SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS s…8.6
• CVE-2026-46493HAX CMS helps manage microsite universe with PHP or NodeJs b…7.5
• CVE-2026-46496HAX CMS helps manage microsite universe with PHP or NodeJs b…9.3
• CVE-2026-46497Crawlee is a web scraping and browser automation library. Fr…2.3
• CVE-2026-4650The FundPress – WordPress Donation Plugin for WordPress is v…5.3
• CVE-2026-46508Turborepo is a high-performance build system for JavaScript …7.8
• CVE-2026-46509deepobj provides get, set, delete deep objects in javascript…8.2