CVE-2026-126945: Zipline before 4.5.1 Stored XSS via HighlightCode Component
Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.5.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker who can upload a text file can supply HTML or JavaScript content that is stored and later rendered to other users.
What must happen for the payload to execute?
A victim must view the uploaded file while the HighlightCode component renders its unescaped content before highlight.js has finished loading.
Are unauthenticated users able to upload an exploit directly?
The available information identifies authenticated attackers as the upload source; it does not state that unauthenticated uploads are affected.
What can an attacker do in a victim's browser?
The payload can make API calls in the victim's browser context, including actions such as changing the victim's account on their behalf.