Cross-site scripting in HedgeDoc - CVE-2026-58487
Published: November 11, 2026
Vulnerability details
The vulnerability allows a remote user to inject stored HTML into pages viewed by other users, alter page content, and embed attacker-controlled resources.
The vulnerability exists due to improper escaping of email-derived display names in HedgeDoc's publish and slide views and collaborative editor when rendering user information. A remote user can register a specially crafted email address containing a quoted-string local-part that is reused as a display name to break out of an HTML attribute and inject arbitrary markup into pages viewed by other users.
The deployed Content-Security-Policy prevented straightforward inline JavaScript execution but still allowed injected HTML to embed cross-origin iframes.