CVE-2026-90835: michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting
A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments of michaelliao itranswarp up to version 2.19 are affected where page content is rendered through Markdown.toHtml in Markdown.java. The issue is limited to products no longer supported by the maintainer.
What does an attacker need to exploit it?
The attack can be initiated remotely and requires low privileges and user interaction, according to the supplied severity vector. Exploit code has been published, increasing the likelihood of attempted exploitation.
Is a maintainer fix available?
The project was notified through an issue report but had not responded at the time of the report. No patch or fixed version is identified in the available data.
What can teams do if they cannot patch?
No specific mitigation is provided. Because the vulnerable behavior is Markdown.toHtml page-content rendering, prioritize reducing exposure to untrusted content processed by that function until a supported replacement or fix is available.