EUVD-2026-56029
GHSA-3fwq-xc2g-q79x
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L reflects required workspace membership; S:C applies because injected script executes in other users' browser contexts; UI:R as the victim must navigate to the compromised plant entry; no availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can use this to steal session cookies or perform actions in the context of other users including administrators.
AnalysisAI
Persistent JavaScript injection in HortusFox 5.9 enables authenticated workspace members to execute arbitrary scripts in the browsers of all users who view affected plant notes, including administrators. The vulnerability stems from Parsedown's Markdown renderer operating without safe mode, allowing raw HTML and script tags embedded in plant notes to pass through to the DOM unescaped. An attacker with workspace membership can harvest session cookies or perform privileged actions on behalf of any user who visits the compromised plant entry. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
HortusFox is a self-hosted plant management web application developed by Daniel Brendel (CPE: cpe:2.3:a:daniel_brendel:hortusfox:*:*:*:*:*:*:*:*). Plant notes are processed through Parsedown, a popular PHP Markdown-to-HTML library, which when run without its 'setSafeMode(true)' flag leaves raw HTML elements - including script tags and event handlers - intact in its output. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: user-supplied Markdown content is stored in the database and later re-rendered in other users' browser contexts without sanitization or Content Security Policy mitigation. The scope-change in CVSS (S:C) reflects that the injected payload executes under the security origin of the HortusFox instance, affecting principals other than the attacker.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis - the sole reference provided is the upstream GitHub repository at https://github.com/danielbrendel/hortusfox-web, which should be monitored for a fix release. As a primary compensating control, administrators should enable Parsedown safe mode in the HortusFox codebase by calling setSafeMode(true) on Parsedown instances that render user-supplied plant notes; this strips raw HTML from Markdown output at the cost of disabling any intentional HTML formatting in notes. As an additional control, a strict Content Security Policy header (e.g., script-src 'self') can prevent inline script execution even if HTML slips through. Access to workspace membership should be restricted to fully trusted users until a patch is available, as any authenticated member is a potential attacker.
A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbi
A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute a
A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers
A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute ar
A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers t
HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. Rated medium severity (CVSS 5.4), this v
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today