PT-2026-146789

CVE-2026-126945

Published

2026-11-13

Updated

2026-11-14

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Zipline versions prior to 4.5.1

Description A stored cross-site scripting issue exists in the HighlightCode component. The component renders unescaped file content before the highlight.js library finishes loading. Authenticated attackers can upload text files containing HTML or JavaScript payloads that execute in the browsers of users who view the files. This can allow unauthorized API calls, such as modifying account details on behalf of the victim.

Recommendations Update to version 4.5.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Mtolley

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers