CVE-2026-126800

@hydrooj/ui-default stored XSS in Markdown rendering

critical · 9.3

Fix listed

@hydrooj/ui-default

Published Nov 11, 2026, 20:53 UTC

Description

Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when administrators or other users view it, stealing the non-httpOnly sid session cookie for session hijacking.

Reported fixed versions

4.59.1

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.