What is the CVSS score of CVE-2026-23630?

CVE-2026-23630 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Docmost are affected by CVE-2026-23630?

Organizations using versions 0.3.0 should be aware of moderate risk from CVE-2026-23630, a cross-site scripting vulnerability rated CVSS 5.4.. A patch is available.

Is there a public PoC exploit available for CVE-2026-23630?

Yes, a public proof-of-concept exploit is available for CVE-2026-23630. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23630?

Within 30 days: Identify affected systems running versions 0.3.0 and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Docmost CVE-2026-23630

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-01-21 security-advisories@github.com

XSS Docmost

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 17, 2026 - 16:50 vuln.today

Public exploit code

Patch released

Feb 17, 2026 - 16:50 nvd

Patch available

CVE Published

Jan 21, 2026 - 23:15 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0.

AnalysisAI

Stored XSS in Docmost 0.3.0-0.23.2 allows authenticated users to execute arbitrary JavaScript in the browsers of document viewers through malicious Mermaid diagram code blocks. The vulnerability exists because unsanitized SVG/HTML output from Mermaid rendering is directly injected into the DOM, and Mermaid's security controls can be disabled via diagram directives. Public exploit code exists for this vulnerability, which is fixed in version 0.24.0.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Docmost. Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execut

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 0.24.0.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.