Read the docs
TI-2026-59246 Aliases CVE-2026-86644GHSA-rhvg-pc25-4r8p

star7th showdoc API Page Save Endpoint editormd.js cross site scripting

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is able to resolve this issue. This patch is called a8ea1520850b4242f395247f72e87e597506cef0. Upgrading the affected component is recommended. The vendor confirms: "The fix [...] sets Mermaid `securityLevel` to `strict`, disables `htmlLabels`, and sanitizes rendered SVG with DOMPurify."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed showdoc (star7th): 3.9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
star7thshowdoc3.9.0; 3.9.13.9.2Patch availableCNA
  • showdoc Vendorstar7th Affected 3.9.0; 3.9.1 Fixed in 3.9.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:showdoc:showdoc:*:*:*:*:*:*:*:*——star7th
  • cpe:2.3:a:showdoc:showdoc:*:*:*:*:*:*:*:* Versions — — ·star7th

Remediation

  • Fix · CNA showdoc (star7th) Fixed in 3.9.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86644
  2. 2026-10-03 Alias added: GHSA-rhvg-pc25-4r8p

References

Exploit 1

Patch 2

Other 1

  • TI-2025-00432 ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution CVSS 4.0CRITICAL 9.4
  • TI-2021-14768 Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary… CVSS 3.1CRITICAL 9.8
  • TI-2022-00287 SQL Injection in star7th/showdoc CVSS 3.1CRITICAL 9.8
  • TI-2021-18398 ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions. CVSS 3.1CRITICAL 9.8
  • TI-2026-83553 Code injection in ShowDoc Mock templates lets users run commands CVSS 4.0HIGH 8.7
  • TI-2021-03036 Cross-Site Request Forgery (CSRF) in star7th/showdoc CVSS 3.1HIGH 8.8
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences