HedgeDoc CVE-2026-58489

Exploitation requires three concurrent conditions: (1) the target HedgeDoc instance must have GitHub OAuth integration configured with valid clientID and clientSecret, enabling the Gist export feature; (2) the victim must be actively authenticated to HedgeDoc at the time of the attack; and (3) the victim must click a specifically crafted callback URL delivered by the attacker. Limiting factors include: the attacker must possess a valid GitHub OAuth authorization code of their own to inject into the forged callback, requiring the attacker to also have a GitHub account; user interaction is mandatory and cannot be automated or performed without victim action; and the attack window is constrained to users with active HedgeDoc sessions. Exploitation is not possible against instances with GitHub integration disabled, unauthenticated users, or users who do not interact with the crafted link.

The CVSS 4.0 score of 6.8 reflects meaningful real-world risk constrained by exploitation complexity. The AV:N/UI:A combination means the attacker must operate over the network and requires active victim interaction, limiting the window for mass exploitation. AC:H and AT:P signal that the attacker must first obtain a valid GitHub OAuth code of their own and precisely craft the forged callback URL - non-trivial preconditions. The confidentiality impact is high for both victim (VC:H) and subsequent system (SC:H), since private or protected notes can be silently exfiltrated to an attacker-controlled Gist, which may subsequently be public. There is no integrity or availability impact. EPSS data is not provided, and there is no KEV listing or public POC, suggesting this is not currently being mass-exploited. The realistic risk is targeted exfiltration of sensitive notes from specific users rather than broad opportunistic attacks. The requirement for the victim to be authenticated to HedgeDoc and to click a crafted link reduces the attack surface but does not eliminate risk in collaborative environments where note links are routinely shared.

An attacker authenticates to their own GitHub account and initiates an OAuth authorization flow to obtain a valid GitHub authorization code. They then construct a forged HedgeDoc Gist export callback URL - pointing to /auth/github/callback/<victim-note-id>/gist - embedding their own valid code and any arbitrary state string. When a logged-in HedgeDoc user clicks the crafted link (delivered via phishing, a shared document, or embedded in a note), HedgeDoc's callback handler uses the victim's active session to resolve the target note but uses the attacker's authorization code to acquire a GitHub access token, causing the note's content to be posted as a Gist under the attacker's GitHub account.