SB20261111145 - Multiple vulnerabilities in HedgeDoc

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261111145

SB20261111145 - Multiple vulnerabilities in HedgeDoc

Published: November 11, 2026

Security Bulletin ID SB20261111145
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-58488)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass rate limits on login and registration requests, enabling repeated login attempts and unrestricted account creation.

The vulnerability exists due to reliance on an untrusted HTTP header for client identification in HedgeDoc's rate-limiting logic when handling requests to /login and /register. A remote attacker can send requests with changing cf-connecting-ip header values, which are trusted even when requests do not originate from Cloudflare, to bypass per-IP rate limits and submit excessive login or registration requests.


2) Cross-site scripting (CVE-ID: CVE-2026-58487)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to inject stored HTML into pages viewed by other users, alter page content, and embed attacker-controlled resources.

The vulnerability exists due to improper escaping of email-derived display names in HedgeDoc's publish and slide views and collaborative editor when rendering user information. A remote user can register a specially crafted email address containing a quoted-string local-part that is reused as a display name to break out of an HTML attribute and inject arbitrary markup into pages viewed by other users.

The deployed Content-Security-Policy prevented straightforward inline JavaScript execution but still allowed injected HTML to embed cross-origin iframes.


3) Improper handling of highly compressed data (CVE-ID: CVE-2026-58486)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a persistent denial of service by exhausting CPU resources and blocking the Node.js event loop.

The vulnerability exists due to uncontrolled YAML alias expansion in HedgeDoc's note frontmatter processing when handling requests to the publish or editor view. A remote user can create a note containing a compact YAML alias bomb and request its publish view, or its editor view when the payload is under the opengraph key, to trigger excessive processing and make the instance unavailable.

The malicious note remains stored in the database and can trigger the denial of service again after process restarts.


4) Cross-site request forgery (CVE-ID: CVE-2026-58489)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose private, protected, or limited note content by causing it to be exported to an attacker-controlled GitHub Gist.

The vulnerability exists due to missing OAuth2 state validation in the GitHub Gist export callback when processing GitHub authorization responses. A remote user can trick a logged-in victim into clicking a forged callback URL containing the user's own valid GitHub authorization code and a state parameter that is present but does not match the expected value to export a note accessible through the victim's session to a GitHub Gist controlled by that user.

Exploitation requires GitHub Gist export to be enabled with a GitHub clientID and clientSecret configured.


Remediation

Install update from vendor's website.

References