Executive Summary

CVE-2025-55474 is a stored Cross-Site Scripting (XSS) vulnerability in the Many Notes application version 0.10.1. It occurs because malicious Markdown files uploaded by users are parsed and sanitized only on the client side using DOMPurify, which is insufficient to block all types of malicious scripts. As a result, attackers can inject JavaScript code into Markdown files that execute when the files are viewed, potentially exploiting SVG-based payloads, DOM clobbering, or mutation XSS techniques. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to severe impacts including theft of cookies or tokens, hijacking of user sessions, full account takeover, unauthorized access to sensitive vault data, and injection of malware or phishing redirects into trusted pages. This can compromise user data and the security of the application environment. [2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if your Many Notes application is running a vulnerable version (prior to v0.10.2) and by checking for the presence of malicious markdown files that contain script tags or other XSS payloads. You can inspect URLs serving markdown files, such as http://localhost/files/2?path=test2.md, for suspicious content. Commands to detect such files might include searching your file storage for markdown files containing script tags, for example using grep: `grep -r '<script>' /path/to/markdown/files`. Additionally, monitoring HTTP requests and responses for suspicious payloads or unexpected JavaScript execution in the markdown rendering routes can help detect exploitation attempts. [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the Many Notes application to version 0.10.2 or later, which fixes the vulnerability by adding MIME type validation for file and vault uploads. Additionally, implement server-side sanitization of markdown content before storing it, enforce a strict Content Security Policy (CSP) to prevent execution of unauthorized scripts, revisit and tighten DOMPurify configuration settings, and rigorously validate uploaded files rather than relying solely on client-side sanitization. [1, 2, 3]

Useful 0 Not Useful 0