CVE-2026-43887: Outline: Stored XSS via Comment Mentions
Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions. As a result, potentially dangerous protocols (e.g., javascript:) are not filtered, introducing a risk of client-side code execution. This vulnerability is fixed in 1.7.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43887?
The severity of CVE-2026-43887 is classified as medium due to the potential for exploitation through unvalidated href attributes.
How do I fix CVE-2026-43887?
To fix CVE-2026-43887, update Outline to a version later than 1.6.1 where the href attributes are properly validated.
What versions of Outline are affected by CVE-2026-43887?
Versions of Outline from 0.84.0 to 1.6.1 are affected by CVE-2026-43887.
What type of vulnerability is CVE-2026-43887?
CVE-2026-43887 is an input validation vulnerability that arises from improper handling of href attributes in mentions.
Who is impacted by CVE-2026-43887?
Users of Outline versions 0.84.0 through 1.6.1 who utilize the comment feature are impacted by CVE-2026-43887.