CVE-2026-126569: Mbin 1.2.1 before 1.11.1 Stored XSS via Markdown Image Nested in Link
Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Mbin versions from 1.2.1 before 1.11.1 are affected. Version 1.11.1 is identified as the fixed release.
What access does an attacker need to exploit this?
An attacker needs an authenticated account and must be able to submit content containing Markdown. Exploitation requires a viewer to load the malicious entry, comment, post, message, or bio.
Where can malicious content be placed?
The vulnerable Markdown can be submitted in entries, comments, posts, messages, and bios. It uses HTML embedded in image alt text within an image nested inside a link.
How can I determine whether my instance has been targeted?
Review user-submitted Markdown in entries, comments, posts, messages, and bios for images nested inside links, especially where image alt text contains HTML. The provided information does not identify a specific detection signature beyond this payload structure.