Description

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is able to resolve this issue. This patch is called a8ea1520850b4242f395247f72e87e597506cef0. Upgrading the affected component is recommended. The vendor confirms: "The fix [...] sets Mermaid `securityLevel` to `strict`, disables `htmlLabels`, and sanitizes rendered SVG with DOMPurify."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-08T14:17:35.087Z",
  "pubdate": "2026-09-08T14:17:35.087Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in ShowDoc versions up to 3.9.1, specifically residing within the web_src/public/editor.md/editormd.js file of the API Page Save component.\nThe vulnerability allows remote attackers to inject malicious scripts into the application, which are subsequently executed in the context of the victim's browser session.\nThis flaw poses a significant security risk, as successful exploitation enables unauthorized access to sensitive user data, session hijacking, or malicious redirection.\nThe exploit is publicly disclosed, increasing the risk of active exploitation by threat actors.\nThe vendor has addressed this issue by mandating stricter security configurations within the Mermaid rendering engine, disabling specific HTML rendering features, and implementing DOMPurify for sanitizing SVG output.\nImmediate upgrade to version 3.9.2 is strongly advised to mitigate this vulnerability.",
  "technicalDetails": "The vulnerability originates from improper handling of user-supplied input during the saving process of the page editor component, specifically within the Editormd library implementation in web_src/public/editor.md/editormd.js.\nThe root cause is identified as the insecure rendering of Mermaid diagrams within the editor, which allowed for the injection and execution of arbitrary JavaScript via crafted input strings that were not sufficiently sanitized before being processed by the browser.\nAttackers can leverage this vulnerability remotely by supplying malicious payloads to the API Page Save endpoint. When a victim views the affected page, the malicious script embedded in the Mermaid diagram syntax is rendered and executed by the browser.\nThe technical flow involves the following steps: 1) An attacker submits a specially crafted request containing a malicious payload disguised as Mermaid diagram syntax to the page save endpoint. 2) The application accepts this input and stores it without adequate sanitization. 3) When an unsuspecting user navigates to the rendered page, the browser interprets the malicious payload as valid executable code rather than plain text. 4) The script executes within the security context of the user's session, potentially allowing the attacker to perform unauthorized actions, access cookies, or exfiltrate sensitive application data.\nThe vulnerability is persistent, as the malicious payload is stored server-side and executed each time the affected page is rendered. The lack of strict security headers or input sanitization on the server-side, coupled with insecure rendering behavior on the client-side, allows for the injection of XSS payloads.\nThe remediation patch (a8ea1520850b4242f395247f72e87e597506cef0) introduces a hardened posture for the Mermaid integration by explicitly setting the 'securityLevel' configuration to 'strict'. This mode restricts the functionality that can be invoked via Mermaid syntax, effectively disabling the 'htmlLabels' feature, which was a common vector for XSS. Furthermore, the integration of DOMPurify provides a robust layer of sanitization for rendered SVG objects, ensuring that any malicious tags or event handlers injected into the SVG are stripped out before the document object model (DOM) is updated."
}