HedgeDoc
CVE-2026-58489
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no privileges; victim must click crafted link (UI:R); scope changes as note content crosses to attacker's GitHub Gist (S:C); AC:H reflects need for attacker's own valid OAuth code.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export flow created an OAuth2 state value but only checked that it was present rather than validating it against the value expected for the user's session. Because the state was not properly validated, an attacker could forge a callback URL containing their own valid GitHub OAuth code. When processing the callback, HedgeDoc used the victim's logged-in session to select which note to export, but the attacker's authorization code to determine which GitHub account received it. As a result, a logged-in victim who clicked a crafted link could export their own private, protected, or limited note directly into a Gist controlled by the attacker. This issue has been fixed in version 1.11.0.
AnalysisAI
HedgeDoc's GitHub Gist export feature exposes private and protected note content to attacker-controlled GitHub accounts via OAuth2 state parameter forgery. Versions prior to 1.11.0 generated an OAuth2 state token during the Gist export flow but validated only its presence - not its binding to the initiating user session - enabling a cross-site request forgery attack. An attacker who tricks a logged-in victim into clicking a crafted callback URL can redirect the victim's note export to the attacker's own GitHub Gist, bypassing any note visibility controls. No public exploit code or CISA KEV listing is identified at time of analysis, but a confirmed patch exists in version 1.11.0.
Technical ContextAI
HedgeDoc is an open-source Node.js collaborative markdown application (CPE: cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*). The affected code path is in lib/response.js and lib/web/note/actions.js, which together implement GitHub OAuth2 for the Gist export feature. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery): the OAuth2 state parameter is meant to be a cryptographically random, session-bound nonce that ties the authorization request to the initiating session, preventing callback URL injection. The pre-1.11.0 code checked if (!code || !state) - verifying only that the state field was non-empty - without comparing it against the session-stored value (req.session.githubGistState). The fix (commit fbd7307f) explicitly reads sessionsState from the session, deletes it to prevent replay, and gates further processing on sessionsState !== state failing. This is a textbook OAuth2 CSRF mitigation pattern.
RemediationAI
Upgrade HedgeDoc to version 1.11.0, which introduces proper session-bound OAuth2 state validation in the Gist export callback handler (commit fbd7307f162754212046ec343cbe691223a48c8d). The fix stores the generated state in the user session and enforces an exact match on callback, with immediate deletion to prevent replay. If an immediate upgrade is not possible, the most effective compensating control is to disable the GitHub integration entirely by removing the GitHub clientID and clientSecret from the HedgeDoc configuration, which removes the vulnerable code path; the trade-off is loss of Gist export functionality for all users. Restricting network access to the HedgeDoc instance to trusted users reduces the social engineering surface but does not eliminate the vulnerability since the attack is user-driven. Vendor advisory and fix reference: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-8v9p-5j95-826j and https://github.com/hedgedoc/hedgedoc/commit/fbd7307f162754212046ec343cbe691223a48c8d.
HedgeDoc is a collaborative platform for writing and sharing markdown. Rated high severity (CVSS 8.7), this vulnerabilit
HedgeDoc is software for creating real-time collaborative markdown notes. Rated high severity (CVSS 8.2), this vulnerabi
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Rated medium severity (CVSS 6.5), this
HedgeDoc is open source software which lets you create real-time collaborative markdown notes. Rated medium severity (CV
HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. Rated critical severity (CVSS 10.0)
HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. Rated medium severity (CVSS 5.8), t
Denial of service in HedgeDoc before 1.11.0 lets a user who can store a note crash the instance by embedding a YAML "ali
HedgeDoc is a collaborative platform for writing and sharing markdown. Rated high severity (CVSS 7.5), this vulnerabilit
Rate-limiting bypass in HedgeDoc prior to 1.11.0 permits unauthenticated remote attackers to circumvent brute-force prot
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Rated medium severity (CVSS 6.4), this
HedgeDoc is a platform to write and share markdown. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
HedgeDoc is a platform to write and share markdown. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today