PT-2026-135500
CVE-2026-120500
·
Published
2026-11-02
·
Updated
2026-11-02
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.
Found an issue in the description? Have something to add? Feel free to write us 👾