GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-53427 (GCVE-0-2026-53427)

Vulnerability from cvelistv5 – Published: 2026-06-29 18:50 – Updated: 2026-06-30 04:37
VLAI
Title
Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown. When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line <div>. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '"><script>alert(1)</script>' terminates the class attribute early and the markup that follows is emitted as live HTML. An attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required. The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched. This issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-29 19:18 UTC
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version CPE status
leandrocp mdex Affected: 0.11.3 , < 0.12.3 (semver)
    cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*
Create a notification for this product.
leandrocp mdex Affected: 0d7ffc84ea742e1daf666426814e5bb6d0499433 , < 6ed94d905f97af188323f042698ae841c02293b4 (git)
    cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*
Create a notification for this product.
leandrocp mdex_native Affected: 0.1.0 , < 0.2.3 (semver)
    cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*
Create a notification for this product.
leandrocp mdex_native Affected: 956528c5e31746253347029e810a969ab916fd27 , < 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3 (git)
    cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Peter Ullrich Leandro Pereira Jonatan Männchen / EEF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53427",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-29T19:18:13.166991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-29T19:19:28.028Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.MDEx\u0027",
            "comrak_nif"
          ],
          "packageName": "mdex",
          "packageURL": "pkg:hex/mdex",
          "product": "mdex",
          "programFiles": [
            "native/comrak_nif/src/lumis_adapter.rs"
          ],
          "programRoutines": [
            {
              "name": "comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes"
            },
            {
              "name": "comrak_nif::lumis_adapter::LumisAdapter::highlight_lines_config"
            },
            {
              "name": "comrak_nif::lumis_adapter::LumisAdapter::write_highlighted"
            },
            {
              "name": "\u0027Elixir.MDEx\u0027:to_html/2"
            }
          ],
          "repo": "https://github.com/leandrocp/mdex",
          "vendor": "leandrocp",
          "versions": [
            {
              "lessThan": "0.12.3",
              "status": "affected",
              "version": "0.11.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.MDEx\u0027",
            "comrak_nif"
          ],
          "packageName": "leandrocp/mdex",
          "packageURL": "pkg:github/leandrocp/mdex",
          "product": "mdex",
          "programFiles": [
            "native/comrak_nif/src/lumis_adapter.rs"
          ],
          "programRoutines": [
            {
              "name": "comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes"
            },
            {
              "name": "comrak_nif::lumis_adapter::LumisAdapter::highlight_lines_config"
            },
            {
              "name": "comrak_nif::lumis_adapter::LumisAdapter::write_highlighted"
            },
            {
              "name": "\u0027Elixir.MDEx\u0027:to_html/2"
            }
          ],
          "repo": "https://github.com/leandrocp/mdex",
          "vendor": "leandrocp",
          "versions": [
            {
              "lessThan": "6ed94d905f97af188323f042698ae841c02293b4",
              "status": "affected",
              "version": "0d7ffc84ea742e1daf666426814e5bb6d0499433",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.MDExNative.Comrak\u0027",
            "mdex_native_nif"
          ],
          "packageName": "mdex_native",
          "packageURL": "pkg:hex/mdex_native",
          "product": "mdex_native",
          "programFiles": [
            "native/mdex_native_nif/src/lumis_adapter.rs"
          ],
          "programRoutines": [
            {
              "name": "mdex_native_nif::lumis_adapter::LumisAdapter::parse_custom_attributes"
            },
            {
              "name": "mdex_native_nif::lumis_adapter::LumisAdapter::highlight_lines_config"
            },
            {
              "name": "mdex_native_nif::lumis_adapter::LumisAdapter::write_highlighted"
            },
            {
              "name": "\u0027Elixir.MDExNative.Native\u0027:document_to_html_with_options/2"
            },
            {
              "name": "\u0027Elixir.MDExNative.Comrak\u0027:document_to_html/2"
            }
          ],
          "repo": "https://github.com/leandrocp/mdex_native",
          "vendor": "leandrocp",
          "versions": [
            {
              "lessThan": "0.2.3",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.MDExNative.Comrak\u0027",
            "mdex_native_nif"
          ],
          "packageName": "leandrocp/mdex_native",
          "packageURL": "pkg:github/leandrocp/mdex_native",
          "product": "mdex_native",
          "programFiles": [
            "native/mdex_native_nif/src/lumis_adapter.rs"
          ],
          "programRoutines": [
            {
              "name": "mdex_native_nif::lumis_adapter::LumisAdapter::parse_custom_attributes"
            },
            {
              "name": "mdex_native_nif::lumis_adapter::LumisAdapter::highlight_lines_config"
            },
            {
              "name": "mdex_native_nif::lumis_adapter::LumisAdapter::write_highlighted"
            },
            {
              "name": "\u0027Elixir.MDExNative.Native\u0027:document_to_html_with_options/2"
            },
            {
              "name": "\u0027Elixir.MDExNative.Comrak\u0027:document_to_html/2"
            }
          ],
          "repo": "https://github.com/leandrocp/mdex_native",
          "vendor": "leandrocp",
          "versions": [
            {
              "lessThan": "798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3",
              "status": "affected",
              "version": "956528c5e31746253347029e810a969ab916fd27",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerable code path is only reachable when MDEx is configured with a syntax-highlighting formatter (for example \u003ctt\u003esyntax_highlight: [formatter: {:html_inline, ...}]\u003c/tt\u003e or \u003ctt\u003e{:html_linked, ...}\u003c/tt\u003e) and with full info-string forwarding enabled (\u003ctt\u003erender: [full_info_string: true]\u003c/tt\u003e). Full info-string forwarding is required for comrak to hand the \u003ctt\u003ehighlight_lines_class\u003c/tt\u003e attribute to the highlighter, so any application that uses the line-highlighting attributes already has it enabled.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerable code path is only reachable when MDEx is configured with a syntax-highlighting formatter (for example syntax_highlight: [formatter: {:html_inline, ...}] or {:html_linked, ...}) and with full info-string forwarding enabled (render: [full_info_string: true]). Full info-string forwarding is required for comrak to hand the highlight_lines_class attribute to the highlighter, so any application that uses the line-highlighting attributes already has it enabled."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.12.3",
                  "versionStartIncluding": "0.11.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "AND"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.2.3",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "AND"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Leandro Pereira"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\u003c/p\u003e\u003cp\u003eWhen syntax highlighting and full info-string forwarding (\u003ctt\u003erender: [full_info_string: true]\u003c/tt\u003e) are enabled, the Lumis adapter copies the value of a code fence\u0027s \u003ctt\u003ehighlight_lines_class\u003c/tt\u003e info-string attribute, unescaped, into the \u003ctt\u003eclass\u003c/tt\u003e attribute of every rendered line. \u003ctt\u003ecomrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes\u003c/tt\u003e in \u003ctt\u003enative/comrak_nif/src/lumis_adapter.rs\u003c/tt\u003e shlex-parses the info string and stores each \u003ctt\u003ekey=value\u003c/tt\u003e pair verbatim, \u003ctt\u003ehighlight_lines_config\u003c/tt\u003e pulls \u003ctt\u003ehighlight_lines_class\u003c/tt\u003e into the per-line class value, and \u003ctt\u003ewrite_highlighted\u003c/tt\u003e interpolates that value directly into the \u003ctt\u003eclass\u003c/tt\u003e attribute of the per-line \u003ctt\u003e\u0026lt;div\u0026gt;\u003c/tt\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as \u003ctt\u003e\u0027\u0026quot;\u0026gt;\u0026lt;script\u0026gt;alert(1)\u0026lt;/script\u0026gt;\u0027\u003c/tt\u003e terminates the \u003ctt\u003eclass\u003c/tt\u003e attribute early and the markup that follows is emitted as live HTML.\u003c/p\u003e\u003cp\u003eAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\u003c/p\u003e\u003cp\u003eThe vulnerable native code originally shipped inside \u003ctt\u003emdex\u003c/tt\u003e (in \u003ctt\u003enative/comrak_nif/src/lumis_adapter.rs\u003c/tt\u003e) and was later extracted into the separate \u003ctt\u003emdex_native\u003c/tt\u003e package (\u003ctt\u003enative/mdex_native_nif/src/lumis_adapter.rs\u003c/tt\u003e), where it remains unpatched.\u003c/p\u003e\u003cp\u003eThis issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\n\nWhen syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence\u0027s highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line \u003cdiv\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as \u0027\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u0027 terminates the class attribute early and the markup that follows is emitted as live HTML.\n\nAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\n\nThe vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.\n\nThis issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T04:37:51.902Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/leandrocp/mdex_native/security/advisories/GHSA-v664-pmxr-mxxx"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-53427.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53427"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leandrocp/mdex_native/commit/798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDo not enable full info-string forwarding (\u003ctt\u003erender: [full_info_string: true]\u003c/tt\u003e) when rendering untrusted Markdown, which prevents the \u003ctt\u003ehighlight_lines_class\u003c/tt\u003e attribute from reaching the highlighter. Alternatively, restrict \u003ctt\u003ehighlight_lines_class\u003c/tt\u003e values to a safe character set (for example \u003ctt\u003e[A-Za-z0-9_- ]\u003c/tt\u003e) before rendering.\u003c/p\u003e"
            }
          ],
          "value": "Do not enable full info-string forwarding (render: [full_info_string: true]) when rendering untrusted Markdown, which prevents the highlight_lines_class attribute from reaching the highlighter. Alternatively, restrict highlight_lines_class values to a safe character set (for example [A-Za-z0-9_- ]) before rendering."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-53427",
    "datePublished": "2026-06-29T18:50:17.185Z",
    "dateReserved": "2026-06-09T11:01:47.529Z",
    "dateUpdated": "2026-06-30T04:37:51.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53427",
      "date": "2026-09-16",
      "epss": "0.00688",
      "percentile": "0.5102"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53427\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-06-29T19:16:41.597\",\"lastModified\":\"2026-06-29T20:17:38.650\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\\n\\nWhen syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence\u0027s highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line \u003cdiv\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as \u0027\\\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u0027 terminates the class attribute early and the markup that follows is emitted as live HTML.\\n\\nAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\\n\\nThe vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.\\n\\nThis issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"leandrocp\",\"product\":\"mdex\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"mdex\",\"cpes\":[\"cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.MDEx\u0027\",\"comrak_nif\"],\"programFiles\":[\"native/comrak_nif/src/lumis_adapter.rs\"],\"programRoutines\":[{\"name\":\"comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes\"},{\"name\":\"comrak_nif::lumis_adapter::LumisAdapter::highlight_lines_config\"},{\"name\":\"comrak_nif::lumis_adapter::LumisAdapter::write_highlighted\"},{\"name\":\"\u0027Elixir.MDEx\u0027:to_html/2\"}],\"repo\":\"https://github.com/leandrocp/mdex\",\"packageURL\":\"pkg:hex/mdex\",\"versions\":[{\"version\":\"0.11.3\",\"lessThan\":\"0.12.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"leandrocp\",\"product\":\"mdex\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"leandrocp/mdex\",\"cpes\":[\"cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.MDEx\u0027\",\"comrak_nif\"],\"programFiles\":[\"native/comrak_nif/src/lumis_adapter.rs\"],\"programRoutines\":[{\"name\":\"comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes\"},{\"name\":\"comrak_nif::lumis_adapter::LumisAdapter::highlight_lines_config\"},{\"name\":\"comrak_nif::lumis_adapter::LumisAdapter::write_highlighted\"},{\"name\":\"\u0027Elixir.MDEx\u0027:to_html/2\"}],\"repo\":\"https://github.com/leandrocp/mdex\",\"packageURL\":\"pkg:github/leandrocp/mdex\",\"versions\":[{\"version\":\"0d7ffc84ea742e1daf666426814e5bb6d0499433\",\"lessThan\":\"6ed94d905f97af188323f042698ae841c02293b4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"leandrocp\",\"product\":\"mdex_native\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"mdex_native\",\"cpes\":[\"cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.MDExNative.Comrak\u0027\",\"mdex_native_nif\"],\"programFiles\":[\"native/mdex_native_nif/src/lumis_adapter.rs\"],\"programRoutines\":[{\"name\":\"mdex_native_nif::lumis_adapter::LumisAdapter::parse_custom_attributes\"},{\"name\":\"mdex_native_nif::lumis_adapter::LumisAdapter::highlight_lines_config\"},{\"name\":\"mdex_native_nif::lumis_adapter::LumisAdapter::write_highlighted\"},{\"name\":\"\u0027Elixir.MDExNative.Native\u0027:document_to_html_with_options/2\"},{\"name\":\"\u0027Elixir.MDExNative.Comrak\u0027:document_to_html/2\"}],\"repo\":\"https://github.com/leandrocp/mdex_native\",\"packageURL\":\"pkg:hex/mdex_native\",\"versions\":[{\"version\":\"0.1.0\",\"lessThan\":\"0.2.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"leandrocp\",\"product\":\"mdex_native\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"leandrocp/mdex_native\",\"cpes\":[\"cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.MDExNative.Comrak\u0027\",\"mdex_native_nif\"],\"programFiles\":[\"native/mdex_native_nif/src/lumis_adapter.rs\"],\"programRoutines\":[{\"name\":\"mdex_native_nif::lumis_adapter::LumisAdapter::parse_custom_attributes\"},{\"name\":\"mdex_native_nif::lumis_adapter::LumisAdapter::highlight_lines_config\"},{\"name\":\"mdex_native_nif::lumis_adapter::LumisAdapter::write_highlighted\"},{\"name\":\"\u0027Elixir.MDExNative.Native\u0027:document_to_html_with_options/2\"},{\"name\":\"\u0027Elixir.MDExNative.Comrak\u0027:document_to_html/2\"}],\"repo\":\"https://github.com/leandrocp/mdex_native\",\"packageURL\":\"pkg:github/leandrocp/mdex_native\",\"versions\":[{\"version\":\"956528c5e31746253347029e810a969ab916fd27\",\"lessThan\":\"798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-29T19:18:13.166991Z\",\"id\":\"CVE-2026-53427\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-53427.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/leandrocp/mdex_native/commit/798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/leandrocp/mdex_native/security/advisories/GHSA-v664-pmxr-mxxx\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-53427\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-53427\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-29T19:18:13.166991Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-29T19:19:09.581Z\"}}], \"cna\": {\"title\": \"Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Leandro Pereira\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-63\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-63 Cross-Site Scripting (XSS)\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/leandrocp/mdex\", \"vendor\": \"leandrocp\", \"modules\": [\"\u0027Elixir.MDEx\u0027\", \"comrak_nif\"], \"product\": \"mdex\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.11.3\", \"lessThan\": \"0.12.3\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/mdex\", \"packageName\": \"mdex\", \"programFiles\": [\"native/comrak_nif/src/lumis_adapter.rs\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes\"}, {\"name\": \"comrak_nif::lumis_adapter::LumisAdapter::highlight_lines_config\"}, {\"name\": \"comrak_nif::lumis_adapter::LumisAdapter::write_highlighted\"}, {\"name\": \"\u0027Elixir.MDEx\u0027:to_html/2\"}]}, {\"cpes\": [\"cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/leandrocp/mdex\", \"vendor\": \"leandrocp\", \"modules\": [\"\u0027Elixir.MDEx\u0027\", \"comrak_nif\"], \"product\": \"mdex\", \"versions\": [{\"status\": \"affected\", \"version\": \"0d7ffc84ea742e1daf666426814e5bb6d0499433\", \"lessThan\": \"6ed94d905f97af188323f042698ae841c02293b4\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/leandrocp/mdex\", \"packageName\": \"leandrocp/mdex\", \"programFiles\": [\"native/comrak_nif/src/lumis_adapter.rs\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes\"}, {\"name\": \"comrak_nif::lumis_adapter::LumisAdapter::highlight_lines_config\"}, {\"name\": \"comrak_nif::lumis_adapter::LumisAdapter::write_highlighted\"}, {\"name\": \"\u0027Elixir.MDEx\u0027:to_html/2\"}]}, {\"cpes\": [\"cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/leandrocp/mdex_native\", \"vendor\": \"leandrocp\", \"modules\": [\"\u0027Elixir.MDExNative.Comrak\u0027\", \"mdex_native_nif\"], \"product\": \"mdex_native\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.1.0\", \"lessThan\": \"0.2.3\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/mdex_native\", \"packageName\": \"mdex_native\", \"programFiles\": [\"native/mdex_native_nif/src/lumis_adapter.rs\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"mdex_native_nif::lumis_adapter::LumisAdapter::parse_custom_attributes\"}, {\"name\": \"mdex_native_nif::lumis_adapter::LumisAdapter::highlight_lines_config\"}, {\"name\": \"mdex_native_nif::lumis_adapter::LumisAdapter::write_highlighted\"}, {\"name\": \"\u0027Elixir.MDExNative.Native\u0027:document_to_html_with_options/2\"}, {\"name\": \"\u0027Elixir.MDExNative.Comrak\u0027:document_to_html/2\"}]}, {\"cpes\": [\"cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/leandrocp/mdex_native\", \"vendor\": \"leandrocp\", \"modules\": [\"\u0027Elixir.MDExNative.Comrak\u0027\", \"mdex_native_nif\"], \"product\": \"mdex_native\", \"versions\": [{\"status\": \"affected\", \"version\": \"956528c5e31746253347029e810a969ab916fd27\", \"lessThan\": \"798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/leandrocp/mdex_native\", \"packageName\": \"leandrocp/mdex_native\", \"programFiles\": [\"native/mdex_native_nif/src/lumis_adapter.rs\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"mdex_native_nif::lumis_adapter::LumisAdapter::parse_custom_attributes\"}, {\"name\": \"mdex_native_nif::lumis_adapter::LumisAdapter::highlight_lines_config\"}, {\"name\": \"mdex_native_nif::lumis_adapter::LumisAdapter::write_highlighted\"}, {\"name\": \"\u0027Elixir.MDExNative.Native\u0027:document_to_html_with_options/2\"}, {\"name\": \"\u0027Elixir.MDExNative.Comrak\u0027:document_to_html/2\"}]}], \"references\": [{\"url\": \"https://github.com/leandrocp/mdex_native/security/advisories/GHSA-v664-pmxr-mxxx\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-53427.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-53427\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/leandrocp/mdex_native/commit/798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3\", \"tags\": [\"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Do not enable full info-string forwarding (render: [full_info_string: true]) when rendering untrusted Markdown, which prevents the highlight_lines_class attribute from reaching the highlighter. Alternatively, restrict highlight_lines_class values to a safe character set (for example [A-Za-z0-9_- ]) before rendering.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eDo not enable full info-string forwarding (\u003ctt\u003erender: [full_info_string: true]\u003c/tt\u003e) when rendering untrusted Markdown, which prevents the \u003ctt\u003ehighlight_lines_class\u003c/tt\u003e attribute from reaching the highlighter. Alternatively, restrict \u003ctt\u003ehighlight_lines_class\u003c/tt\u003e values to a safe character set (for example \u003ctt\u003e[A-Za-z0-9_- ]\u003c/tt\u003e) before rendering.\u003c/p\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\\n\\nWhen syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence\u0027s highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line \u003cdiv\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as \u0027\\\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u0027 terminates the class attribute early and the markup that follows is emitted as live HTML.\\n\\nAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\\n\\nThe vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.\\n\\nThis issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\u003c/p\u003e\u003cp\u003eWhen syntax highlighting and full info-string forwarding (\u003ctt\u003erender: [full_info_string: true]\u003c/tt\u003e) are enabled, the Lumis adapter copies the value of a code fence\u0027s \u003ctt\u003ehighlight_lines_class\u003c/tt\u003e info-string attribute, unescaped, into the \u003ctt\u003eclass\u003c/tt\u003e attribute of every rendered line. \u003ctt\u003ecomrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes\u003c/tt\u003e in \u003ctt\u003enative/comrak_nif/src/lumis_adapter.rs\u003c/tt\u003e shlex-parses the info string and stores each \u003ctt\u003ekey=value\u003c/tt\u003e pair verbatim, \u003ctt\u003ehighlight_lines_config\u003c/tt\u003e pulls \u003ctt\u003ehighlight_lines_class\u003c/tt\u003e into the per-line class value, and \u003ctt\u003ewrite_highlighted\u003c/tt\u003e interpolates that value directly into the \u003ctt\u003eclass\u003c/tt\u003e attribute of the per-line \u003ctt\u003e\u0026lt;div\u0026gt;\u003c/tt\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as \u003ctt\u003e\u0027\u0026quot;\u0026gt;\u0026lt;script\u0026gt;alert(1)\u0026lt;/script\u0026gt;\u0027\u003c/tt\u003e terminates the \u003ctt\u003eclass\u003c/tt\u003e attribute early and the markup that follows is emitted as live HTML.\u003c/p\u003e\u003cp\u003eAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\u003c/p\u003e\u003cp\u003eThe vulnerable native code originally shipped inside \u003ctt\u003emdex\u003c/tt\u003e (in \u003ctt\u003enative/comrak_nif/src/lumis_adapter.rs\u003c/tt\u003e) and was later extracted into the separate \u003ctt\u003emdex_native\u003c/tt\u003e package (\u003ctt\u003enative/mdex_native_nif/src/lumis_adapter.rs\u003c/tt\u003e), where it remains unpatched.\u003c/p\u003e\u003cp\u003eThis issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The vulnerable code path is only reachable when MDEx is configured with a syntax-highlighting formatter (for example syntax_highlight: [formatter: {:html_inline, ...}] or {:html_linked, ...}) and with full info-string forwarding enabled (render: [full_info_string: true]). Full info-string forwarding is required for comrak to hand the highlight_lines_class attribute to the highlighter, so any application that uses the line-highlighting attributes already has it enabled.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe vulnerable code path is only reachable when MDEx is configured with a syntax-highlighting formatter (for example \u003ctt\u003esyntax_highlight: [formatter: {:html_inline, ...}]\u003c/tt\u003e or \u003ctt\u003e{:html_linked, ...}\u003c/tt\u003e) and with full info-string forwarding enabled (\u003ctt\u003erender: [full_info_string: true]\u003c/tt\u003e). Full info-string forwarding is required for comrak to hand the \u003ctt\u003ehighlight_lines_class\u003c/tt\u003e attribute to the highlighter, so any application that uses the line-highlighting attributes already has it enabled.\u003c/p\u003e\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"0.12.3\", \"versionStartIncluding\": \"0.11.3\"}], \"operator\": \"AND\"}, {\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"0.2.3\", \"versionStartIncluding\": \"0.1.0\"}], \"operator\": \"AND\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-06-29T18:50:17.185Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-53427\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-29T19:19:28.028Z\", \"dateReserved\": \"2026-06-09T11:01:47.529Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-06-29T18:50:17.185Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.