CVE-2026-126945 · Runtime
NO FIX YET · SEE WHAT TO DO
Zipline, a self-hosted file sharing server, renders uploaded text files without escaping them in its HighlightCode component before highlight.js loads. An authenticated user can upload a text file containing JavaScript that runs in the browser of anyone who views it, and can make API calls such as account changes as that victim.
first public Mar 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run Zipline and let users upload or view text files in the web interface. Exposure depends on the version in use; instances that only the operator uses, with no untrusted uploaders or viewers, carry much less risk. The sources do not describe a non-default setting that is required.
Not affected if version-4.5.1-or-later
Who cares file-sharing, self-hosted, zipline
4.5.1 are affected.4.5.1 or later.Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.