Cross-site scripting in Wiki.js - #VU165827
Published: November 11, 2026
Vulnerability identifier: #VU165827
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in the wiki origin, steal session tokens, and perform actions as victims, including administrators.
The vulnerability exists due to improper validation of URL schemes in navigation.updateTree and the sidebar component nav-sidebar.vue when storing and rendering navigation link targets. A remote user can use the manage:navigation or manage:system permission to store a link target containing javascript:... and induce a victim to click the sidebar link, executing JavaScript that can read the jwt cookie and take over the victim's session.
The global sidebar displays the malicious link on every page for every viewer, including guests.
Affected software
Wiki.js
Remediation
Install security update from vendor's website.
Wiki.js - update to 3.1.0