CVE-2026-86644

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86644

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86644.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86644

Published

2026-09-08T13:30:14Z

Modified

2026-09-10T03:48:34Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

star7th showdoc API Page Save Endpoint editormd.js cross site scripting

Details

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is able to resolve this issue. This patch is called a8ea1520850b4242f395247f72e87e597506cef0. Upgrading the affected component is recommended. The vendor confirms: "The fix [...] sets Mermaid securityLevel to strict, disables htmlLabels, and sanitizes rendered SVG with DOMPurify."

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86644.json"
}

References

Affected packages

Git / github.com/star7th/showdoc

Affected ranges

Type

GIT

Repo

https://github.com/star7th/showdoc

Events

Introduced

d9c786685d8b4ccdff00450303b523ed128cb871

Fixed

a8ea1520850b4242f395247f72e87e597506cef0

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "3.9.0"
        },
        {
            "last_affected": "3.9.0"
        },
        {
            "introduced": "3.9.1"
        },
        {
            "last_affected": "3.9.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*

3.9.0

3.9.1

v3.*

v3.9.0

v3.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86644.json"