CVE-2026-41653

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41653
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41653.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41653
Aliases
  • GHSA-6vh8-4frx-647f
Published
2026-05-07T18:43:17.797Z
Modified
2026-08-04T11:50:57.244276264Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration
Details

BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may be able to execute arbitrary JavaScript in certain circumstances in Markdown to PDF Tool. This issue has been patched in version 2.8.3.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41653.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/alam00000/bentopdf

Affected ranges

Type
GIT
Repo
https://github.com/alam00000/bentopdf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
28b4f3ebc4588836662f1fc0dd316ebe06ebe417
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.8.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.0.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.10.0
v1.10.1
v1.10.3
v1.10.4
v1.10.5
v1.11.0
v1.11.1
v1.11.2
v1.14.0
v1.15.1
v1.15.3
v1.15.4
v1.16.0
v1.16.1
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.9.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.3
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.8.0
v2.8.1
v2.8.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41653.json"