{"id":"CVE-2026-120500","published":"2026-11-02T16:17:34.007","lastModified":"2026-11-02T19:35:33.347","description":"An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.","cvssScore":6.1,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/redimp/otterwiki/commit/b2e91d20ed36c01ce140d18698f9abb90685d481","tags":[]},{"url":"https://github.com/redimp/otterwiki/releases/tag/v2.26.2","tags":[]},{"url":"https://www.vulncheck.com/advisories/an-otter-wiki-before-2.26.2-stored-xss-via-math-code-block","tags":[]}],"exploitRefs":[{"url":"https://github.com/redimp/otterwiki/commit/b2e91d20ed36c01ce140d18698f9abb90685d481","tags":[]},{"url":"https://github.com/redimp/otterwiki/releases/tag/v2.26.2","tags":[]}],"hasPoc":true,"ai":null}