CVE-2026-24127

Summary

Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template login.twig of versions 2.19.1 and below. The username value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.

Affected Software

Weaknesses

• CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-116: CWE-116: Improper Encoding or Escaping of Output

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr
• https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c
• https://github.com/typemill/typemill/releases/tag/v2.19.2

• ←Previous
• Next→