CVE-2026-53529: LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)
LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the payload could execute in the victim’s browser. The impact depends on deployment configuration. With --public-access enabled, unauthenticated visitors could be affected. In authenticated-only deployments, the issue could be used for cross-user XSS against logged-in users who can access search results. The issue has been fixed in version 0.10.2 by ensuring that author-controlled page titles in search results are not interpreted as raw HTML by the browser while preserving search result highlighting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LeafWikito a version that resolves this vulnerability.Fixed in 0.10.2
Event History
Frequently Asked Questions
Who can exploit this issue and who can be affected?
An editor or administrator who can create or modify page titles can store an HTML/JavaScript payload in a title. Any user who searches for a matching term may execute that payload; this includes unauthenticated visitors when --public-access is enabled, or logged-in users able to access search results in authenticated-only deployments.
Are default or authenticated-only deployments affected?
Authenticated-only deployments are affected if users who can access search results search for titles containing a malicious payload. Public exposure requires --public-access to be enabled.
How can I determine whether my deployment is vulnerable?
LeafWiki versions before 0.10.2 are affected. Review whether untrusted editors or administrators could have created page titles containing HTML or JavaScript, and whether users can search for those titles.
What should be done to remediate the issue?
Upgrade LeafWiki to version 0.10.2, which prevents author-controlled page titles in search results from being interpreted as raw HTML while retaining highlighting. If public access is enabled, consider the exposure to unauthenticated search users when prioritizing the upgrade.