Otter Wiki EUVD-2026-115252

The attacker must be able to edit a wiki page and must place HTML markup inside a `math fenced code block, which block_code renders without escaping. Under Otter Wiki's default configuration anonymous users can edit pages, so no authentication is required (PR:N); deployments hardened to require login or disable anonymous editing raise the bar to an authenticated editor. Exploitation of a victim additionally requires that victim to view the poisoned page (UI:P / passive user interaction). Affected: Otter Wiki before 2.26.2; fixed in 2.26.2.

This is a genuine but moderate-priority issue, not an emergency. The CVSS 4.0 base score is 5.3 (medium), and the vulnerability is a stored XSS (CWE-79) whose impact is confined to the subsequent system - the browser of each page viewer (SC:L/SI:L, with VC/VI/VA:N on the Otter Wiki server itself). The signals are mostly consistent: AV:N/AC:L means network-reachable and easy to trigger, and PR:N reflects that under the default configuration anonymous users can edit pages, so no authentication is needed to plant the payload; UI:P correctly reflects that a victim must view the poisoned page for the script to fire. The vuln.today decision label is 'this_month' rather than act_now/emergency, which matches the medium severity. No EPSS score and no KEV listing are present in the input, so there is no evidence of active exploitation or a quantified exploitation probability - treat exploitation likelihood as unquantified rather than low. The main risk amplifier is the default anonymous-edit configuration, which removes the usual authentication barrier for a stored-XSS; deployments that disable anonymous editing meaningfully reduce exposure. Overall: patch within a normal cycle, prioritizing internet-facing instances that allow anonymous editing.

Under the default configuration an unauthenticated attacker opens the page editor and saves a page containing a `math fenced code block with embedded markup such as <script>alert(document.domain)</script> or <img src=x onerror=...>. Because OtterwikiMdRenderer.block_code wraps each math line as \[{line}\] without HTML-escaping, the payload is stored and rendered verbatim, executing in the browser of every subsequent viewer. A public PoC payload is demonstrated in the patch's regression test (test_math_block_escapes_html); it is not verified as a standalone working exploit.