CVE-2026-46492 md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
An attacker can execute arbitrary JavaScript in the victim's browser by crafting malicious Markdown files with raw HTML tags.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46492?
CVE-2026-46492 is a high-severity cross-site scripting vulnerability in commenthol md-fileserver, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including <script> tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.
Which versions are affected by CVE-2026-46492?
2 open source packages ship an affected version, including md-fileserver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
md-fileserver npm | All versions | 1.10.3 |
md-fileserver npm | All versions | 1.10.3 |
Products include Commenthol Md-Fileserver.
How do I fix CVE-2026-46492?
Upgrade md-fileserver to 1.10.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-46492 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46492 exists.
Sources
Also known as GHSA-32q2-hhr5-6qvv.