{"id":"CVE-2026-120500","kind":"vulnerability","aliases":["CVE-2026-120500"],"related":[],"title":"Otter Wiki: stored script injection through math code blocks","description":"An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.","summary":"Otter Wiki versions before 2.26.2 render HTML placed inside a math fenced code block without escaping. An attacker who can edit a page, including anonymous users under the default configuration, can store script that runs for every viewer of that page.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","otter-wiki","python","self-hosted"],"not_affected_if":["editing-restricted","version-2.26.2-or-later"],"how_to_check":"- Check the installed Otter Wiki version against `2.26.2`\n- Review whether anonymous editing is enabled on the wiki","fix":"- Otter Wiki: upgrade to `2.26.2` or later","status":"open","published_at":"2026-11-02T16:17:34+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","triaged_at":"2026-11-02T16:26:45+00:00","updated_at":"2026-11-02T16:26:45+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-02T16:26:45Z","model":"claude-haiku-5-5","output":{"fix":"- Otter Wiki: upgrade to `2.26.2` or later","reach":"internet","title":"Otter Wiki: stored script injection through math code blocks","impact":"medium","summary":"Otter Wiki versions before 2.26.2 render HTML placed inside a math fenced code block without escaping. An attacker who can edit a page, including anonymous users under the default configuration, can store script that runs for every viewer of that page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["otter-wiki","self-hosted","python"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Script runs in every viewer's browser, exposing their session","analyst_note":"","how_to_check":"- Check the installed Otter Wiki version against `2.26.2`\n- Review whether anonymous editing is enabled on the wiki","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.26.2-or-later","editing-restricted"],"who_is_affected":"Any Otter Wiki instance running a version before 2.26.2 is exposed, and the default configuration lets anonymous users edit pages. Teams that restrict editing to trusted accounts face less risk, but the stored script still runs for every viewer of an affected page. unknown for any other deployment details.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":4213,"output_tokens":490,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120500':12A,15A '-2026':11A,14A '2.26.2':28B,69C 'allow':82C 'anonym':48B,89C 'arbitrari':97C 'attack':41B,83C,99C 'block':9A,37B,108C 'code':8A,36B,80C,107C 'configur':53B,94C 'contain':70C 'cross':74C 'cross-sit':73C 'cve':10A,13A 'default':52B,93C 'edit':44B,86C 'escap':39B 'everi':60B,116C 'execut':114C 'fenc':35B,106C 'host':23B 'html':30B,102C 'includ':47B,88C 'inject':5A,96C 'insid':32B,103C 'math':7A,34B,105C 'otter':1A,18B,24B,66C 'otter-wiki':17B 'otterwikimdrenderer.block':79C 'page':46B,64B,87C,120C 'place':31B,101C 'python':20B 'render':29B,111C 'run':58B 'script':4A,56B,76C,98C 'self':22B 'self-host':21B 'site':75C 'store':3A,55B,72C 'unescap':112C 'user':49B,90C 'version':26B 'viewer':61B,117C 'vulner':77C 'wiki':2A,19B,25B,67C 'without':38B","nicknames":[],"mitigations":[],"who_affected":"Any Otter Wiki instance running a version before 2.26.2 is exposed, and the default configuration lets anonymous users edit pages. Teams that restrict editing to trusted accounts face less risk, but the stored script still runs for every viewer of an affected page. unknown for any other deployment details.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","otterwiki","python","selfhosted"],"first_public_at":"2026-11-02T16:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120500","severity":null,"published_at":"2026-11-02T16:17:34+00:00","modified_at":"2026-11-02T16:17:34+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","fetched_at":"2026-11-02T16:24:04+00:00","note":null}],"documents":[{"id":52762,"url":"https://github.com/redimp/otterwiki/commit/b2e91d20ed36c01ce140d18698f9abb90685d481","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52763,"url":"https://github.com/redimp/otterwiki/releases/tag/v2.26.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52764,"url":"https://www.vulncheck.com/advisories/an-otter-wiki-before-2.26.2-stored-xss-via-math-code-block","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}