CVE-2026-120500: An Otter Wiki before 2.26.2 Stored XSS via Math Code Block

Published Nov 2, 2026

Updated

An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.blockcode that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.

Event History

Nov 2, 2026

CVE Published

via OSV·03:31 PM

Data Sourced

via OSV·03:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue in a default deployment?

Any user who can edit wiki pages can exploit it. Under the default configuration, this includes anonymous users.

What attacker action triggers the script execution?

The attacker places HTML inside a math fenced code block on an editable page. The content is rendered without escaping, and the script executes when users view that page.

Who is affected when malicious content has been stored?

Every viewer of the affected page can be exposed because the injected script executes when the page is rendered.

What version resolves the issue?

Upgrade Otter Wiki to version 2.26.2 or later. Versions before 2.26.2 are affected.

CVE-2026-120500: An Otter Wiki before 2.26.2 Stored XSS via Math Code Block

Event History

Frequently Asked Questions

Who can exploit this issue in a default deployment?

What attacker action triggers the script execution?

Who is affected when malicious content has been stored?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue in a default deployment?

What attacker action triggers the script execution?

Who is affected when malicious content has been stored?

What version resolves the issue?