CyberRota Analysis
AI-GeneratedA cross-site scripting vulnerability exists in the API Page Save Endpoint of the star7th showdoc application versions up to 3.9.1, specifically in the editormd.js file. This flaw allows remote attackers to execute malicious scripts, potentially compromising user data or session integrity. Organizations using affected versions should prioritize upgrading to version 3.9.2 to mitigate this risk, as the patch enhances security by implementing stricter rendering controls and sanitization measures.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is able to resolve this issue. This patch is called a8ea1520850b4242f395247f72e87e597506cef0. Upgrading the affected component is recommended. The vendor confirms: "The fix [...] sets Mermaid `securityLevel` to `strict`, disables `htmlLabels`, and sanitizes rendered SVG with DOMPurify."