CVE-2024-40626: Stored Cross-site Scripting (XSS) vulnerability in Outline editor
Outline is an open source, collaborative document editor. A type confusion issue was found in ProseMirror’s rendering process that leads to a Stored Cross-Site Scripting (XSS) vulnerability in Outline. An authenticated user can create a document containing a malicious JavaScript payload. When other users view this document, the malicious Javascript can execute in the origin of Outline. Outline includes CSP rules to prevent third-party code execution, however in the case of self-hosting and having your file storage on the same domain as Outline a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions. This issue has been addressed in release version 0.77.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40626?
CVE-2024-40626 has been assigned a high severity rating due to its potential for exploitation leading to Stored Cross-Site Scripting (XSS).
How do I fix CVE-2024-40626?
To fix CVE-2024-40626, update Outline to version 0.77.4 or later, as this version addresses the vulnerability.
Who is affected by CVE-2024-40626?
CVE-2024-40626 affects all versions of Outline up to and including 0.77.3 used by authenticated users.
What type of vulnerability is CVE-2024-40626?
CVE-2024-40626 is a Stored Cross-Site Scripting (XSS) vulnerability caused by a type confusion issue in ProseMirror's rendering process.
Can an attacker exploit CVE-2024-40626 without authentication?
No, an attacker must be authenticated to create a malicious document that exploits CVE-2024-40626.