EUVD-2026-64169Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Network-reachable stored XSS requiring authenticated editor access (PR:L) and victim page load (UI:R); scope unchanged and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated <meta> tags due to missing output encoding. Under certain browser or DOM interaction scenarios, this may lead to stored cross-site scripting (XSS). Version 2.23.0 fixes the issue.
AnalysisAI
Stored HTML attribute injection in Typemill versions prior to 2.23.0 allows authenticated content editors to embed arbitrary HTML attributes into generated og:title and og:description meta tags due to absent output encoding. Under applicable browser or DOM interaction conditions, this escalates to stored cross-site scripting (XSS) against any visitor loading the affected page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Typemill account with permission to edit page metadata - specifically the og:title and og:description fields. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) scores 4.6, accurately reflecting a network-reachable attack surface constrained by two significant limiting factors: the attacker must hold a low-privilege authenticated account (PR:L), and a victim must load the affected page (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Typemill to version 2.23.0 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. Rated high sev
Reflected XSS in Typemill's login error page allows unauthenticated attackers to inject malicious scripts by crafting re
Credential brute-forcing against Typemill CMS (versions up to and including 2.25.0) is possible because its primary pass
Arbitrary file read in Typemill before 2.24.0 allows authenticated Author-level users to traverse outside the content di
Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious Jav
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today