Cross-site scripting in Wiki.js - #VU165824
Published: November 11, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in a page viewer's browser in the wiki's origin, disclose sensitive information, and perform unauthorized actions as the viewer.
The vulnerability exists due to improper neutralization of script-bearing URLs in the Wiki.js block-drawio component and server-side page sanitizer when rendering stored draw.io blocks. A remote user can save <block-drawio server="javascript:alert(document.domain)//"><pre>x</pre></block-drawio> in a page they can edit, causing the unvalidated server value to become an iframe src and execute JavaScript in the wiki's origin when a victim views the page.
Exploitation requires the draw.io block to be enabled, which is the default.