Description

Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdown links using the javascript: scheme through ParsedownExtension.php or TwigMarkdownExtension.php, storing a persistent payload that executes in the browser of every visitor who clicks the link, enabling session cookie theft, authenticated request forgery, and credential harvesting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-10T20:17:30.870Z",
  "pubdate": "2026-08-10T20:17:30.870Z",
  "executiveSummary": "Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability located within the Markdown parser extension.\nThe vulnerability allows authenticated users who possess theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values within Markdown links.\nSuccessfully exploiting this flaw results in the execution of arbitrary JavaScript payloads in the browser of any visitor who interacts with the crafted link.\nThe primary impact includes session cookie theft, the execution of authenticated request forgery, and credential harvesting, posing a severe risk to application integrity and user session security.\nExploitation requires authentication with specific administrative privileges related to theme configuration, enabling the persistence of malicious payloads across the system.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and output encoding within the Markdown parser extension of Typemill CMS version 2.x.\nSpecifically, the components responsible for processing hyperlink attributes—namely ParsedownExtension.php and TwigMarkdownExtension.php—fail to adequately validate or restrict href schemes provided in Markdown syntax.\nAn attacker with administrative access to theme configuration can supply arbitrary Uniform Resource Identifiers utilizing the javascript: protocol instead of standard web-accessible transport schemes such as http: or https:.\nWhen the Markdown parser processes these inputs, the unsanitized javascript: URI is rendered directly into the HTML document's anchor tag href attribute without enforcing strict scheme whitelisting.\nThe attack flow proceeds as follows: First, the privileged attacker crafts a malicious Markdown link containing a JavaScript payload (e.g., [click here](javascript:alert(document.cookie))) and saves it within the application via the vulnerable theme-configuration interface.\nThe application stores this payload persistently in the backend storage mechanism without sanitization.\nSubsequently, when any visitor or administrator views the rendered page and interacts with the malicious link, the browser executes the embedded JavaScript within the context of the victim's session.\nPost-exploitation impact includes unauthorized access to sensitive session tokens, execution of unauthorized state-changing actions via cross-site request forgery primitives, and the potential harvesting of user credentials.\nThe vulnerability is exposed via the web interface, requiring valid authentication and specific theme-configuration privileges to inject the persistent payload."
}