Cross-site scripting in October CMS - #VU156193
Published: October 19, 2026
Vulnerability identifier: #VU156193
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary JavaScript in another backend user's browser within the October CMS backend origin.
The vulnerability exists due to improper HTML sanitization in the BackendFormWidgetsMarkdownEditor form widget when rendering stored markdown previews: the Vue-based path misconfigures the sanitizer, while the legacy jQuery-based path injects unsanitized HTML. A remote privileged user can store raw HTML such as <img src=x onerror=...> in a markdown field to execute arbitrary JavaScript when another backend user opens the same record and its preview renders.
Affected software
October CMS
Remediation
Install security update from vendor's website.
October CMS - update to 4.3.2