CVE WatchAug 12, 2026

CVE-2026-46492

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability e

CVSS

7.2

High

EPSS

0.2%

p14

KEV

—

Exploit Today

0-100

Published: Jun 9, 2026 · Last modified: Aug 12, 2026 · CWE-80 · CWE-87

EPSS · 30d

0.2%EPSS · 30 days0.3%

2026-10-042026-10-31

Technical description

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including <script> tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-620575.3 MED

22.7%

——7Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.3d CVE-2026-527105.3 MED

22.7%

——7Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5.3d CVE-2026-1194795.3 MED

24.3%

——7Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.3d CVE-2026-426944.3 MED

6.8%

——2Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.3d CVE-2026-482025.3 MED

21.2%

——6Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.4d CVE-2026-254675.3 MED

18.5%

——6Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.4d