Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector, low privileges for registration, user interaction required to view page, scope change affects other users, low C/I due to CSP blocking script execution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part of registered email addresses, HedgeDoc was vulnerable to stored HTML Injection through its publish and slide views. An attacker could register a specially crafted email address and inject arbitrary HTML into pages viewed by other users. HedgeDoc accepted RFC 5321 quoted-string local-parts in email addresses during registration. The local-part was then reused as the user's display name without escaping and rendered into HTML in multiple places, including publish and slide views as well as the collaborative editor. An attacker could break out of an HTML attribute and inject arbitrary markup into the page. While the deployed Content-Security-Policy prevented straightforward inline JavaScript execution, the injected HTML was still sufficient to alter page content and embed attacker-controlled resources such as cross-origin iframes. This issue was fixed in version 1.11.0.
AnalysisAI
Stored HTML injection in HedgeDoc prior to 1.11.0 allows low-privileged, registered attackers to inject arbitrary HTML into publish views, slide views, and the collaborative editor by registering an email address with an RFC 5321 quoted-string local-part, which is then rendered as the display name without output encoding. Victims who view affected pages are exposed to content manipulation and attacker-controlled cross-origin iframe embedding; direct JavaScript execution is mitigated by the deployed Content-Security-Policy, but phishing, UI redressing, and resource injection remain viable. No public exploit code has been identified at time of analysis, and no KEV listing exists; the fix is available in version 1.11.0.
Technical ContextAI
HedgeDoc (CPE: cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*) is an open-source, self-hosted, real-time collaborative markdown editor. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). RFC 5321 permits email local-parts wrapped in double quotes to contain characters normally forbidden, such as angle brackets, quotes, and spaces (e.g., '"<div class=evil>"@example.com'). HedgeDoc accepted these quoted-string local-parts during registration and then reused the raw local-part string as the user's display name, inserting it into HTML templates across publish views, slide views, and the collaborative editor without HTML-encoding. An attacker can break out of the surrounding HTML attribute context to inject arbitrary markup. The existing CSP policy blocked inline script execution, limiting the impact relative to full XSS, but permitting persistent content manipulation and embedding of external resources such as cross-origin iframes.
RemediationAI
Upgrade to HedgeDoc version 1.11.0, which resolves this issue by properly escaping the email local-part before using it as a display name in HTML contexts. The vendor advisory is at https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6c2w-8w96-3pcv. If an immediate upgrade is not possible, administrators of public or semi-public instances should consider disabling open registration (restrict registration to known-good email domains or require admin approval) to prevent untrusted parties from submitting crafted email addresses - this eliminates the attack surface entirely for the attacker-registration step, though it has the trade-off of restricting new user onboarding. Additionally, auditing existing registered users for RFC 5321 quoted-string local-parts (i.e., email addresses where the local-part begins with a double-quote character) can identify accounts that may have already registered malicious display names; such accounts should be suspended and their injected content reviewed.
HedgeDoc is a collaborative platform for writing and sharing markdown. Rated high severity (CVSS 8.7), this vulnerabilit
HedgeDoc is software for creating real-time collaborative markdown notes. Rated high severity (CVSS 8.2), this vulnerabi
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Rated medium severity (CVSS 6.5), this
HedgeDoc is open source software which lets you create real-time collaborative markdown notes. Rated medium severity (CV
HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. Rated critical severity (CVSS 10.0)
HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. Rated medium severity (CVSS 5.8), t
Denial of service in HedgeDoc before 1.11.0 lets a user who can store a note crash the instance by embedding a YAML "ali
HedgeDoc is a collaborative platform for writing and sharing markdown. Rated high severity (CVSS 7.5), this vulnerabilit
Rate-limiting bypass in HedgeDoc prior to 1.11.0 permits unauthenticated remote attackers to circumvent brute-force prot
HedgeDoc's GitHub Gist export feature exposes private and protected note content to attacker-controlled GitHub accounts
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Rated medium severity (CVSS 6.4), this
HedgeDoc is a platform to write and share markdown. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today