CVE-2026-24127: Typemill has Reflected XSS via login error view template

Q: What is the severity of CVE-2026-24127?

CVE-2026-24127 is classified as a moderate severity vulnerability due to the risk of reflected XSS attacks.

Q: How do I fix CVE-2026-24127?

To fix CVE-2026-24127, upgrade Typemill to version 2.19.2 or later.

Q: What versions of Typemill are affected by CVE-2026-24127?

Versions of Typemill prior to version 2.19.2 are affected by CVE-2026-24127.

Q: What type of vulnerability is CVE-2026-24127?

CVE-2026-24127 is a reflected Cross-Site Scripting (XSS) vulnerability.

Q: What impact does CVE-2026-24127 have on users?

CVE-2026-24127 could allow an attacker to execute malicious scripts in the context of a user's browser.

Published Jan 23, 2026

Updated

Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template login.twig of versions 2.19.1 and below. The username value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.

Affected Software

2 affected components

Typemill Typemill<=2.19.1

Typemill Typemill<2.19.2

Remediation

Patch Available

https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c

Event History

Jan 23, 2026

CVE Published

via MITRE·11:01 PM

Data Sourced

via MITRE·11:01 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jun 3, 58101

Event

via FIRST·09:16 PM

Frequently Asked Questions

What is the severity of CVE-2026-24127?

CVE-2026-24127 is classified as a moderate severity vulnerability due to the risk of reflected XSS attacks.

How do I fix CVE-2026-24127?

To fix CVE-2026-24127, upgrade Typemill to version 2.19.2 or later.

What versions of Typemill are affected by CVE-2026-24127?