CVE-2026-126946: Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.5.0
Event History
Frequently Asked Questions
Which users and pages are exposed to this issue?
Zipline instances from 4.3.0 before 4.5.0 are affected. JavaScript can execute in the browsers of visitors who open file view pages associated with content from an attacker-controlled authenticated account.
What access does an attacker need?
An attacker needs an authenticated low-privilege Zipline account. They can submit malicious embedTitle, embedDescription, embedSiteName, or embedColor values through PATCH /api/user.
Does exploitation require interaction from a victim?
Yes. A victim must open a file view page that renders the attacker-controlled embed settings in SSR meta tags.