Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-40201 EUVD-2026-26484GHSA-rjmp-rwj4-mv82

@diplodoc/search-extension allows stored XSS via Markdown file title

Published May 1, 2026 · Updated May 5, 2026 · Assigned by mitre

Vendor: diplodoc-platform Product: @diplodoc/search-extension Package: @diplodoc/search-extension Ecosystem: npm

Description

@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file.

Affected products

VendorProductAffectedFixed
diplodoc-platform @diplodoc/search-extension 1.0.0 – < 3.0.3 3.0.3

Affected packages

EcosystemPackageAffectedFixedRecord
npm @diplodoc/search-extension >= 1.0.0, < 3.0.5 3.0.5 GHSA-rjmp-rwj4-mv82

References