{"id":"CVE-2026-126569","kind":"vulnerability","aliases":["CVE-2026-126569"],"related":[],"title":"Mbin: stored cross-site scripting through Markdown image alt text","description":"Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers.","summary":"Mbin, a Markdown-based federated forum, renders nested Markdown image alt text and URLs without HTML escaping. An authenticated user can embed HTML in an image alt text inside a link in entries, comments, posts, messages or bios, so the script runs in other users' browsers.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["federated-forum","mbin","package","self-hosted"],"not_affected_if":["no-user-generated-content","version-1.11.1-or-later"],"how_to_check":"- Check the installed Mbin version; versions from 1.2.1 up to but not including `1.11.1` are listed as affected.\n- Confirm whether untrusted users can post content that is rendered to other users.","fix":"- Mbin: move to `1.11.1` or later.","status":"open","published_at":"2026-11-11T03:16:51+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","triaged_at":"2026-11-11T03:26:26+00:00","updated_at":"2026-11-11T03:26:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T03:26:26Z","model":"claude-haiku-5-5","output":{"fix":"- Mbin: move to `1.11.1` or later.","reach":"internet","title":"Mbin: stored cross-site scripting through Markdown image alt text","impact":"medium","summary":"Mbin, a Markdown-based federated forum, renders nested Markdown image alt text and URLs without HTML escaping. An authenticated user can embed HTML in an image alt text inside a link in entries, comments, posts, messages or bios, so the script runs in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mbin","self-hosted","federated-forum"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs script in other users' browsers, stealing sessions.","analyst_note":"","how_to_check":"- Check the installed Mbin version; versions from 1.2.1 up to but not including `1.11.1` are listed as affected.\n- Confirm whether untrusted users can post content that is rendered to other users.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.11.1-or-later","no-user-generated-content"],"who_is_affected":"Sites running Mbin from 1.2.1 before 1.11.1 where logged-in users can post entries, comments, posts, messages or bios. The flaw needs an account, so sites with closed registration and no untrusted users carry less exposure. Sites already on 1.11.1 or later are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4661,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126569':14A,17A '-2026':13A,16A '1.11.1':76C '1.2.1':74C 'alt':10A,37B,53B,93C,107C 'authent':45B,100C 'base':30B 'bio':64B,121C 'browser':72B,127C 'builddestruct':87C 'comment':60B,117C 'contain':77C 'cross':4A,81C 'cross-sit':3A,80C 'cve':12A,15A 'emb':48B,103C 'embedel':86C 'entri':59B,116C 'escap':43B,99C 'feder':19B,31B 'federated-forum':18B 'forum':20B,32B 'host':25B 'html':42B,49B,98C,104C 'imag':9A,36B,52B,92C,111C 'insid':55B,112C 'link':57B,114C 'markdown':8A,29B,35B,91C 'markdown-bas':28B 'mbin':1A,21B,26B,73C 'messag':62B,119C 'nest':34B,90C 'packag':22B 'post':61B,118C 'render':33B,89C 'run':68B,123C 'script':6A,67B,83C,124C 'self':24B 'self-host':23B 'site':5A,82C 'store':2A,79C 'text':11A,38B,54B,94C,108C 'url':40B,96C 'user':46B,71B,101C 'viewer':126C 'vulner':84C 'without':41B,97C","nicknames":[],"mitigations":[],"who_affected":"Sites running Mbin from 1.2.1 before 1.11.1 where logged-in users can post entries, comments, posts, messages or bios. The flaw needs an account, so sites with closed registration and no untrusted users carry less exposure. Sites already on 1.11.1 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["federatedforum","mbin","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-126569':14A,17A '-2026':13A,16A 'alt':10A 'cross':4A 'cross-sit':3A 'cve':12A,15A 'imag':9A 'markdown':8A 'mbin':1A 'script':6A 'site':5A 'store':2A 'text':11A","search_b":"'alt':37B,53B 'authent':45B 'base':30B 'bio':64B 'browser':72B 'comment':60B 'emb':48B 'entri':59B 'escap':43B 'feder':19B,31B 'federated-forum':18B 'forum':20B,32B 'host':25B 'html':42B,49B 'imag':36B,52B 'insid':55B 'link':57B 'markdown':29B,35B 'markdown-bas':28B 'mbin':21B,26B 'messag':62B 'nest':34B 'packag':22B 'post':61B 'render':33B 'run':68B 'script':67B 'self':24B 'self-host':23B 'text':38B,54B 'url':40B 'user':46B,71B 'without':41B","search_c":"'1.11.1':76C '1.2.1':74C 'alt':93C,107C 'authent':100C 'bio':121C 'browser':127C 'builddestruct':87C 'comment':117C 'contain':77C 'cross':81C 'cross-sit':80C 'emb':103C 'embedel':86C 'entri':116C 'escap':99C 'html':98C,104C 'imag':92C,111C 'insid':112C 'link':114C 'markdown':91C 'mbin':73C 'messag':119C 'nest':90C 'post':118C 'render':89C 'run':123C 'script':83C,124C 'site':82C 'store':79C 'text':94C,108C 'url':96C 'user':101C 'viewer':126C 'vulner':84C 'without':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:49:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126569","severity":null,"published_at":"2026-11-11T03:16:51+00:00","modified_at":"2026-11-11T03:16:51+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","fetched_at":"2026-11-11T03:25:00+00:00","note":null}],"documents":[{"id":122054,"url":"https://github.com/MbinOrg/mbin/commit/736fd39fe9cd59f5d51636d25e1857d88ddbd0bd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122055,"url":"https://github.com/MbinOrg/mbin/releases/tag/v1.11.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122056,"url":"https://github.com/MbinOrg/mbin/security/advisories/GHSA-g3r9-j6w4-2257","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T22:49:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":122057,"url":"https://www.vulncheck.com/advisories/mbin-1.2.1-before-1.11.1-stored-xss-via-markdown-image-nested-in-link","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}