XSS vector in slide mode speaker-view
Priority LOW 36CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass, Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346 and CWE-79.
Summary
HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into another page. The problem is patched in version 1.9.0. There are no known workarounds aside from upgrading.
Why it matters now
EPSS 0.00602 49th percentileScored 2026-11-07
Fix Fixed hedgedoc (hedgedoc): 1.9.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA hedgedoc (hedgedoc) Fixed in 1.9.0
Timeline
- 2026-10-02 Threatist record created from CVE-2021-39175
References
More Hedgedoc vulnerabilities
- TI-2023-19867 HedgeDoc API allows to hide existing notes CVSS 3.1HIGH 8.2
- TI-2024-30379 MySQL & free URL mode allows to hide existing notes in hedgedoc CVSS 3.1MEDIUM 6.5
- TI-2021-10188 PDF export allows arbitrary file reads CVSS 3.1CRITICAL 10.0
- TI-2020-16108 Stored XSS in mermaid diagrams CVSS 3.1HIGH 8.7
- TI-2021-10211 Improper Neutralization of Script-Related HTML Tags in Notes CVSS 3.1HIGH 8.1
- TI-2020-16107 Arbitary file upload CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences