CVE-2026-126800 · Package
NO FIX YET · SEE WHAT TO DO
The Hydro online judge's default UI package before 4.59.1 fails to escape double quotes in language class names during markdown rendering, so a registered user can store script in their profile bio. When an administrator or another user views that bio, the script runs and can read the non-httpOnly sid session cookie, letting an attacker take over that session.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Hydro online judge instances running @hydrooj/ui-default before 4.59.1 are exposed, since the flaw sits in its markdown rendering of user profile content. Any site that lets users write markdown bios and shows them to admins is at risk. Instances already on 4.59.1 or later are not affected by this flaw.
Not affected if version-4.59.1-or-later
Who cares hydro, hydrooj, self-hosted, ui-default
@hydrooj/ui-default in the Hydro installation; versions below 4.59.1 are affected.markdown-it-xss.ts in the @hydrooj/ui-default package and confirm the language class handling.@hydrooj/ui-default moves to or later.Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when administrators or other users view it, stealing the non-httpOnly sid session cookie for session hijacking.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
4.59.1