CVE-2024-40626
- Source
- https://cve.org/CVERecord?id=CVE-2024-40626
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-40626.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-40626
- Aliases
-
- GHSA-888c-mvg8-v6wh
- Published
- 2024-07-16T17:03:39.883Z
- Modified
- 2026-04-10T05:15:24.620494Z
- Severity
-
- 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Stored Cross-site Scripting (XSS) vulnerability in Outline editor
- Details
-
Outline is an open source, collaborative document editor. A type confusion issue was found in ProseMirror’s rendering process that leads to a Stored Cross-Site Scripting (XSS) vulnerability in Outline. An authenticated user can create a document containing a malicious JavaScript payload. When other users view this document, the malicious Javascript can execute in the origin of Outline. Outline includes CSP rules to prevent third-party code execution, however in the case of self-hosting and having your file storage on the same domain as Outline a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions. This issue has been addressed in release version 0.77.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40626.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ] }- References
Affected packages
Git / github.com/outline/outline
Affected ranges
- Type
- GIT
- Repo
- https://github.com/outline/outline
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed