What is the CVSS score of CVE-2026-43887?

CVE-2026-43887 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Outline are affected by CVE-2026-43887?

Outline collaborative documentation (versions 0.84.0-1.6.1) contains a stored XSS vulnerability in comment mentions that allows authenticated users to inject malicious code, compromising other users'…. A patch is available.

How to fix or mitigate CVE-2026-43887?

Within 24 hours, identify all Outline deployments and verify current versions. Within 7 days, upgrade all instances to Outline 1.7.0 or later, which includes the vendor-released patch. Within 30 days, audit comment history for suspicious mentions containing javascript: protocol URLs, review user access logs for unauthorized activity during the vulnerable period, and validate successful patch deployment across all environments.

Outline CVE-2026-43887

EUVD-2026-29331 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 GitHub_M

XSS RCE Outline

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Authenticated commenter needed (PR:L) and victim must render the payload (UI:R); stored script executes in another user's session, crossing an authority boundary (S:C), with high C/I and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:35 vuln.today

Patch available

May 11, 2026 - 23:03 EUVD

CVE Published

May 11, 2026 - 21:05 nvd

HIGH 7.3

DescriptionGitHub Advisory

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions. As a result, potentially dangerous protocols (e.g., javascript:) are not filtered, introducing a risk of client-side code execution. This vulnerability is fixed in 1.7.0.

AnalysisAI

Stored cross-site scripting in Outline collaborative documentation (versions 0.84.0 through 1.6.1) lets an authenticated user inject a mention in the comment section whose href attribute is never validated, so dangerous protocols such as javascript: survive rendering and execute in a viewing user's browser. When a victim interacts with the malicious mention, attacker-controlled script runs in their session, enabling account-context actions and data theft; publicly available exploit code exists but there is no evidence of active exploitation and EPSS probability is negligible (0.04%). The issue is resolved in Outline 1.7.0.

Technical ContextAI

Outline is a Node.js-based team knowledge-base/wiki application that renders user-authored rich text, including comment threads with @-style user mentions represented as HTML anchors. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the backend accepts the href attribute of a mention without allow-listing safe URL schemes, so pseudo-protocols like javascript: (and potentially data:) pass through into the DOM. Because the injected markup is persisted in a comment and later served to other viewers, this behaves as stored/persistent XSS rather than reflected - the payload executes whenever another authenticated user renders the affected comment. The CPE cpe:2.3:a:outline:outline:*:*:*:*:*:*:*:* identifies the affected application as the Outline product line across all editions in the vulnerable range.

RemediationAI

Upgrade to Outline 1.7.0 or later, which is the vendor-released fixed version that validates/sanitizes mention href attributes (Vendor-released patch: 1.7.0); review the advisory at https://github.com/outline/outline/security/advisories/GHSA-rqrg-f3qc-xvgh before deploying. If you cannot patch immediately, reduce exposure by restricting who can post comments and mentions - for example limit commenting to trusted internal accounts and disable or tighten guest/public collaboration, accepting the trade-off of reduced open collaboration. As additional hardening, front the instance with a strict Content-Security-Policy that forbids inline script and javascript: URIs, which blunts this class of XSS but may break other inline behaviors and must be tested against Outline's own front-end; also advise users not to click unexpected mention links until patched. These are compensating controls only - upgrading to 1.7.0 is the definitive fix.