CVE-2026-126800

Name of the Vulnerable Software and Affected Versions @hydrooj/ui-default versions prior to 4.59.1

Description A stored cross-site scripting issue exists where registered users can inject scripts by placing double quotes in language- class tokens within markdown-it-xss.ts. An attacker can store a malicious payload in their profile bio, which executes when administrators or other users view the profile. This can lead to the theft of the non-httpOnly sid session cookie, enabling session hijacking.

Recommendations Update to version 4.59.1.