Read the docs
TI-2026-83875 Aliases CVE-2026-120500GHSA-2fv3-2f7j-2vq4

Stored cross-site scripting in Otter Wiki via math code block

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

An Otter Wiki before 2.26.2 is affected by a stored cross-site scripting flaw in OtterwikiMdRenderer.block_code, tracked as CWE-79. The renderer outputs HTML placed inside a math fenced code block without escaping it. An unauthenticated remote attacker who can edit pages, including anonymous users under the default configuration, can store script that runs for every viewer of the page, which requires user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.

Why it matters now

EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed otterwiki (redimp): 2.26.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
redimpotterwiki2.0.0 to before 2.26.22.26.2Patch availableCNA
  • otterwiki Vendorredimp Affected 2.0.0 to before 2.26.2 Fixed in 2.26.2 Patch available CNA

Remediation

Upgrade redimp otterwiki to version 2.26.2 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA otterwiki (redimp) Fixed in 2.26.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    redimp otterwiki 2.26.2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-83876 Repository file disclosure via DataTable src in Otter WikiPriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120500
  2. 2026-11-02 Alias added: GHSA-2fv3-2f7j-2vq4

References

Patch 1

Other 1

  • TI-2026-83876 Repository file disclosure via DataTable src in Otter Wiki CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences