CVE-2026-86644: star7th showdoc API Page Save Endpoint editormd.js cross site scripting
A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file websrc/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is able to resolve this issue. This patch is called a8ea1520850b4242f395247f72e87e597506cef0. Upgrading the affected component is recommended. The vendor confirms: "The fix [...] sets Mermaid securityLevel to strict, disables htmlLabels, and sanitizes rendered SVG with DOMPurify."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
star7th showdoc API Page Save Endpoint editormd.jsto a version that resolves this vulnerability.Fixed in 3.9.2Patch a8ea1520850b4242f395247f72e87e597506cef0 - Configuration
Apply the vendor fix to set Mermaid `securityLevel` to `strict` to prevent unsafe rendering that could lead to cross site scripting.
Mermaid (used by showdoc editor) securityLevel = strict - Configuration
Apply the vendor fix to disable Mermaid `htmlLabels`.
showdoc Mermaid renderer htmlLabels = disabled - Configuration
Apply the vendor fix to sanitize rendered SVG using DOMPurify.
showdoc rendered SVG handling (DOMPurify) DOMPurify sanitization = enabled
Event History
Frequently Asked Questions
Which ShowDoc installations are affected?
Star7th ShowDoc versions up to and including 3.9.1 are affected. Version 3.9.2 resolves the issue.
What access and interaction does exploitation require?
The issue can be attacked remotely, but the published severity vector indicates an attacker needs low-level privileges and user interaction. Successful exploitation can affect integrity, while no confidentiality or availability impact is identified.
What should be done if upgrading is not immediately possible?
The provided data identifies version 3.9.2 as the remediation and recommends upgrading the affected component. Its fix sets Mermaid securityLevel to strict, disables htmlLabels, and sanitizes rendered SVG with DOMPurify.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.