CVE-2026-53758: Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized
Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including <script> tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization, resulting in stored XSS visible to all site visitors. At time of publication, there are no publicly known patches.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create or modify article content containing Markdown. Raw HTML, including script tags, can then be stored in the article and executed when visitors view it.
Are ordinary site visitors at risk?
Yes. The malicious content is rendered to all visitors who view the affected article, so exploitation does not require visitors to be authenticated or to take action beyond loading the page.
What versions are affected, and is a patch available?
Emlog 2.6.29 and earlier are affected. At the time of publication, no publicly known patch was available.
What can be done before a patch is available?
Restrict article creation and editing to trusted users, and review existing article Markdown for raw HTML such as script tags. Removing or neutralizing untrusted raw HTML from stored content reduces the immediate exposure.