CVE-2026-53529

Name of the Vulnerable Software and Affected Versions LeafWiki versions prior to 0.10.2

Description Page titles returned by the search API can be rendered as raw HTML in the frontend. A user with editor or administrator permissions can create or modify a page title containing an HTML/JavaScript payload. When another user searches for a matching term, the payload executes in the victim's browser. This is a stored Cross-Site Scripting (XSS) issue, where the highlight() function returns the raw title into dangerouslySetInnerHTML. If --public-access is enabled, unauthenticated visitors may be affected; otherwise, the issue impacts logged-in users with search access.

Recommendations Update to version 0.10.2.