Description

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (`og:title` and `og:description`). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated `<meta>` tags due to missing output encoding. Under certain browser or DOM interaction scenarios, this may lead to stored cross-site scripting (XSS). Version 2.23.0 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-21T22:16:38.570Z",
  "pubdate": "2026-08-21T22:16:38.570Z",
  "executiveSummary": "Typemill versions prior to 2.23.0 suffer from a stored HTML attribute injection vulnerability residing within the page metadata fields, specifically targeting the og:title and og:description parameters. This security flaw stems from a lack of proper output encoding on user-supplied metadata inputs before they are rendered within generated HTML meta tags. An authenticated user possessing permissions to modify page metadata can inject arbitrary HTML attributes, which under specific browser or Document Object Model (DOM) interaction scenarios can escalate into stored cross-site scripting (XSS). The risk implication of this vulnerability involves the potential execution of malicious scripts in the context of other users' sessions, potentially compromising administrative or editorial integrity depending on user interaction and browser behavior. Exploitation of this vulnerability requires authentication, specific page modification privileges, and the ability to input malicious payloads into the vulnerable metadata fields. The issue is fully resolved in Typemill version 2.23.0 through the implementation of proper output sanitization and encoding mechanisms.",
  "technicalDetails": "The vulnerability is classified as a stored HTML attribute injection leading to potential stored cross-site scripting (XSS), affecting Typemill versions prior to 2.23.0. The root cause of the flaw is the absence of adequate output encoding and input sanitization on metadata fields, specifically the og:title and og:description parameters processed by the application's metadata handling components. When an authenticated user with sufficient privileges to modify page metadata supplies crafted input containing malicious HTML attribute strings, the application reflects these inputs directly into the rendered HTML document inside metadata tags without neutralizing special characters.\nThe attack flow begins when an authenticated actor with page modification privileges interacts with the content management system interface to edit or create a page. The attacker inserts a malicious payload into the og:title or og:description metadata input vectors. Upon saving the page, Typemill stores the unsanitized payload within the underlying flat-file storage mechanism. When a victim or administrator subsequently requests the affected page, the server retrieves the stored metadata and dynamically generates the corresponding HTML meta tags, outputting the unescaped payload directly into the response body.\nBecause the output context lacks proper attribute-context encoding, the injected string breaks out of the intended HTML attribute boundaries, allowing the introduction of arbitrary attributes or event handlers depending on the exact DOM rendering behavior. Under certain browser parsing conditions or DOM interaction scenarios, this attribute injection facilitates stored cross-site scripting, enabling the execution of arbitrary JavaScript within the security context of the victim's browser session. The affected components are the page metadata generation and rendering routines. Prerequisites for successful exploitation include authenticated access to the application, specific authorization levels allowing metadata modification, and the target application running an affected version prior to 2.23.0."
}