CVE-2026-58487

Name of the Vulnerable Software and Affected Versions HedgeDoc versions prior to 1.11.0

Description Stored HTML Injection occurs due to unsafe handling of the local-part of registered email addresses. The application accepts RFC 5321 quoted-string local-parts during registration and reuses this data as the user's display name without proper escaping. This allows an attacker to inject arbitrary HTML into the collaborative editor, publish views, and slide views. Although the Content-Security-Policy prevents inline JavaScript execution, the injection can be used to modify page content and embed cross-origin iframes.

Recommendations Update to version 1.11.0.