CVE-2026-53468: Typemill has Stored HTML Attribute Injection in Metadata Fields
Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated <meta> tags due to missing output encoding. Under certain browser or DOM interaction scenarios, this may lead to stored cross-site scripting (XSS). Version 2.23.0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Typemillto a version that resolves this vulnerability.Fixed in 2.23.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has permission to modify page metadata can exploit it by supplying crafted values in the og:title or og:description fields. It is not described as exploitable by an unauthenticated visitor.
Which deployments are affected?
Typemill versions earlier than 2.23.0 are affected where users can modify page metadata. The vulnerable behavior occurs when metadata values are emitted into generated meta tags without output encoding.
What is the impact of successful exploitation?
The injected content is stored and can introduce arbitrary HTML attributes into generated meta tags. In certain browser or DOM interaction scenarios, this can result in stored cross-site scripting, with potential confidentiality and integrity impact.
How can the issue be remediated?
Upgrade Typemill to version 2.23.0, which fixes the issue. If an immediate upgrade is not possible, restrict page-metadata modification permissions to trusted users.
How can administrators identify potentially affected content?
Review page metadata values for og:title and og:description on systems running a version earlier than 2.23.0. Look for values containing HTML attribute syntax or other crafted markup that could alter the generated meta tags.