Cross-site scripting in Apache Allura Markdown handling (CVE-2026-73237)

Apache Allura contains a cross-site scripting (XSS) vulnerability in its Markdown processing pipeline. An attacker exploiting this vulnerability could execute malicious scripts in the context of affected users' browsers. Affected versions: - Apache Allura 1.10.0 before 1.19.1 We recommend updating to: 1.19.1. CVSS ? · our assessment: act_now Reference: https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0 Details: https://vuln.today/cve/CVE-2026-73237