CVE-2026-24127

MEDIUM

5.4

Descricao

Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.

Detalhes CVE

Pontuacao CVSS v3.15.4

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioREQUIRED

Publicado1/23/2026

Ultima modificacao2/2/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

typemill:typemill

Fraquezas (CWE)

CWE-79CWE-116CWE-79

Referencias

https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c(security-advisories@github.com)

https://github.com/typemill/typemill/releases/tag/v2.19.2(security-advisories@github.com)

https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.