7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46492

CVE-2026-46492: md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including <script> tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46492

CVE-2026-46492:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
md-fileserver	npm	< 1.10.3	1.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored/reflected Cross-Site Scripting (XSS) issue in the md-fileserver package. The root cause is the application's configuration to allow raw HTML (html: true) in the markdown-it library, combined with a failure to sanitize the output or apply a Content Security Policy (CSP) before rendering it in a user's browser. An attacker could create a markdown file containing malicious HTML and JavaScript. When a victim views this file, the malicious script executes in their browser, in the context of the application's domain.

The analysis of the patch between the vulnerable version 1.10.2 and the patched version 1.10.3 reveals that the fix was to add a Content-Security-Policy HTTP header. This header is added in two key functions: renderRequest in lib/markd.js and renderConfig in lib/renderConfig.js. These are the functions responsible for generating and sending the HTML response for markdown files and the configuration page, respectively. By adding a restrictive CSP, the patch prevents the browser from executing inline scripts or loading scripts from untrusted sources, thus mitigating the XSS vulnerability even though the raw HTML is still present in the rendered output.

Vulnerable functions

renderRequest

lib/markd.js

This function is responsible for rendering a markdown file and sending it as an HTML response. Prior to the patch, it did not set a Content Security Policy (CSP). Because the markdown renderer was configured to allow raw HTML, any malicious script tags within the markdown file would be included in the response and executed by the victim's browser. The patch mitigates this by adding a restrictive CSP header to the response.

renderConfig

lib/renderConfig.js

This function renders the application's configuration page, which can include markdown content. Similar to `renderRequest`, this function was vulnerable because it sent the rendered HTML to the browser without a Content Security Policy. This allowed for cross-site scripting if the rendered content contained malicious HTML. The patch adds a CSP header to the HTTP response to prevent the execution of untrusted scripts.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.