Live › vulnerability › CVE-2026-120500
Otter Wiki versions before 2.26.2 render HTML placed inside a math fenced code block without escaping. An attacker who can edit a page, including anonymous users under the default configuration, can store script that runs for every viewer of that page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Any Otter Wiki instance running a version before 2.26.2 is exposed, and the default configuration lets anonymous users edit pages. Teams that restrict editing to trusted accounts face less risk, but the stored script still runs for every viewer of an affected page. unknown for any other deployment details.
No product ranges from the sources yet.
2.26.22.26.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.
This page as .md · .json · in your agent: get_signal("CVE-2026-120500")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.