CVE-2026-53468

Received Received - Intake

Stored XSS in Typemill via Metadata Injection

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (`og:title` and `og:description`). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated `<meta>` tags due to missing output encoding. Under certain browser or DOM interaction scenarios, this may lead to stored cross-site scripting (XSS). Version 2.23.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53468

Affected Vendors & Products

Vendor	Product	Version / Range
typemill	typemill	to 2.23.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Typemill is a flat-file CMS vulnerable to stored HTML attribute injection in page metadata fields (og:title and og:description) in versions before 2.23.0. Authenticated users with metadata editing rights can inject arbitrary HTML attributes into meta tags due to missing output encoding. This may lead to stored cross-site scripting (XSS) under specific browser or DOM interaction conditions.

Detection Guidance

Check Typemill version with: grep -r "version" /path/to/typemill/config.php. If version is below 2.23.0, the system is vulnerable. Inspect page metadata fields (og:title, og:description) for HTML attribute injection by viewing page source and searching for unexpected attributes in meta tags.

Impact Analysis

An attacker with access could inject malicious scripts into metadata fields, potentially stealing user sessions, redirecting to phishing sites, or defacing pages. The impact depends on user permissions and browser behavior but primarily affects data integrity and confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data security) requirements. Organizations using affected versions may face compliance breaches if user data is compromised through XSS attacks.

Mitigation Strategies

Upgrade Typemill to version 2.23.0 or later immediately. If immediate upgrade is not possible, restrict metadata editing permissions to trusted users only and monitor for suspicious activity in meta tags.

Hi! I’m here to help you understand CVE-2026-53468. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70