CVE-2026-23630: Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering
Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23630?
CVE-2026-23630 is classified as a high severity vulnerability due to its potential for stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2026-23630?
To fix CVE-2026-23630, upgrade to Docmost version 0.24.0 or later where the vulnerability has been addressed.
What versions of Docmost are affected by CVE-2026-23630?
Versions 0.3.0 through 0.23.2 of Docmost are affected by CVE-2026-23630.
What type of vulnerability is CVE-2026-23630?
CVE-2026-23630 is a stored Cross-Site Scripting (XSS) vulnerability.
Can CVE-2026-23630 lead to data compromise?
Yes, CVE-2026-23630 can lead to data compromise through the execution of malicious scripts on user systems.