GHSA-g3r9-j6w4-2257: Mbin 1.2.1 before 1.11.1 Stored XSS via Markdown Image Nested in Link

Published Nov 11, 2026

Updated

Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers.

Event History

Nov 11, 2026

CVE Published

via OSV·02:36 AM

Data Sourced

via OSV·02:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability, and where can the payload be placed?

An authenticated user can exploit it by placing HTML in the alt text of a Markdown image nested inside a link. The affected content locations are entries, comments, posts, messages, and user bios.

Who is exposed to the malicious script?

People who view the attacker-controlled content in their browser may have script run in that browser. The vulnerability is stored, so the payload can affect subsequent viewers of the saved content.

Which versions are affected and what version fixes the issue?

Mbin versions from 1.2.1 before 1.11.1 are affected. Version 1.11.1 is identified as the release containing the fix.

GHSA-g3r9-j6w4-2257: Mbin 1.2.1 before 1.11.1 Stored XSS via Markdown Image Nested in Link

Event History

Frequently Asked Questions

Who can exploit this vulnerability, and where can the payload be placed?

Who is exposed to the malicious script?

Which versions are affected and what version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability, and where can the payload be placed?

Who is exposed to the malicious script?

Which versions are affected and what version fixes the issue?