Ildkh

**Name of the Vulnerable Software and Affected Versions** Remark42 versions 1.6.0 through 1.15.0 **Description** Remark42 contains a Cross-Site Scripting (XSS) issue exploitable through content-type spoofing via the image proxy. The proxy fetches a remote URL and re-serves the response from its own origin. A discrepancy exists between the download phase, which validates the resource as an image by only inspecting the `Content-Type` header, and the serving phase, which uses `http.DetectContentType` to sniff the actual bytes. An attacker can host a URL that advertises `Content-Type: image/png` but contains an HTML/JavaScript body. The proxy accepts the file as an image, but the browser renders it as HTML within the Remark42 origin. This allows the execution of authenticated same-origin API calls, access to the `XSRF-TOKEN` cookie to bypass CSRF protections, and the ability to perform actions as the victim, including administrative tasks if the victim has admin privileges. Exploitation requires no account on the target instance; the attacker only needs to deliver the proxy link to a victim. The vulnerable endpoint is `/api/v1/img` using the `src` parameter. **Recommendations** Update Remark42 to version 1.16.0. For operators using a CDN or edge cache, purge the `/api/v1/img` cache after updating to version 1.16.0.