{"id":"CVE-2026-126945","kind":"vulnerability","aliases":["CVE-2026-126945"],"related":[],"title":"Zipline: stored script injection through uploaded text files in viewers' browsers","description":"Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.","summary":"Zipline, a self-hosted file sharing server, renders uploaded text files without escaping them in its HighlightCode component before highlight.js loads. An authenticated user can upload a text file containing JavaScript that runs in the browser of anyone who views it, and can make API calls such as account changes as that victim.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-sharing","runtime","self-hosted","zipline"],"not_affected_if":["version-4.5.1-or-later"],"how_to_check":"- Check the Zipline version in use; versions before `4.5.1` are affected.\n- Look for a Zipline instance where users can upload text files and other people view them.","fix":"- Zipline: move to `4.5.1` or later.","status":"open","published_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","triaged_at":"2026-11-13T10:48:19+00:00","updated_at":"2026-11-13T10:48:19+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:48:19Z","model":"claude-haiku-5-5","output":{"fix":"- Zipline: move to `4.5.1` or later.","reach":"internet","title":"Zipline: stored script injection through uploaded text files in viewers' browsers","impact":"medium","summary":"Zipline, a self-hosted file sharing server, renders uploaded text files without escaping them in its HighlightCode component before highlight.js loads. An authenticated user can upload a text file containing JavaScript that runs in the browser of anyone who views it, and can make API calls such as account changes as that victim.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["zipline","self-hosted","file-sharing"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in victims' browsers and performs account changes for them","analyst_note":"","how_to_check":"- Check the Zipline version in use; versions before `4.5.1` are affected.\n- Look for a Zipline instance where users can upload text files and other people view them.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.5.1-or-later"],"who_is_affected":"Teams that run Zipline and let users upload or view text files in the web interface. Exposure depends on the version in use; instances that only the operator uses, with no untrusted uploaders or viewers, carry much less risk. The sources do not describe a non-default setting that is required.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000724,"input_tokens":4613,"output_tokens":526,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126945':14A,17A '-2026':13A,16A '4.5.1':82C 'account':75B,123C 'anyon':64B 'api':71B,119C 'attack':105C 'authent':49B,104C 'behalf':129C 'browser':11A,62B,117C 'call':72B,120C 'chang':76B,124C 'compon':44B,94C 'contain':56B,83C,110C 'content':99C 'cross':87C 'cross-sit':86C 'cve':12A,15A 'enabl':118C 'escap':39B 'execut':114C 'file':8A,19B,31B,37B,55B,98C,109C 'file-shar':18B 'finish':102C 'highlight.js':46B,101C 'highlightcod':43B,93C 'host':24B,30B 'html/javascript':111C 'inject':4A 'javascript':57B 'load':47B,103C 'make':70B 'payload':112C 'render':34B,96C 'run':59B 'runtim':21B 'script':3A,89C 'self':23B,29B 'self-host':22B,28B 'server':33B 'share':20B,32B 'site':88C 'store':2A,85C 'text':7A,36B,54B,108C 'unescap':97C 'upload':6A,35B,52B,107C 'user':50B 'victim':79B,127C 'view':66B 'viewer':10A,116C 'vulner':90C 'without':38B 'ziplin':1A,25B,26B,80C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Zipline and let users upload or view text files in the web interface. Exposure depends on the version in use; instances that only the operator uses, with no untrusted uploaders or viewers, carry much less risk. The sources do not describe a non-default setting that is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","filesharing","runtime","selfhosted","zipline"],"campaign_type":null,"search_a":"'-126945':14A,17A '-2026':13A,16A 'browser':11A 'cve':12A,15A 'file':8A 'inject':4A 'script':3A 'store':2A 'text':7A 'upload':6A 'viewer':10A 'ziplin':1A","search_b":"'account':75B 'anyon':64B 'api':71B 'authent':49B 'browser':62B 'call':72B 'chang':76B 'compon':44B 'contain':56B 'escap':39B 'file':19B,31B,37B,55B 'file-shar':18B 'highlight.js':46B 'highlightcod':43B 'host':24B,30B 'javascript':57B 'load':47B 'make':70B 'render':34B 'run':59B 'runtim':21B 'self':23B,29B 'self-host':22B,28B 'server':33B 'share':20B,32B 'text':36B,54B 'upload':35B,52B 'user':50B 'victim':79B 'view':66B 'without':38B 'ziplin':25B,26B","search_c":"'4.5.1':82C 'account':123C 'api':119C 'attack':105C 'authent':104C 'behalf':129C 'browser':117C 'call':120C 'chang':124C 'compon':94C 'contain':83C,110C 'content':99C 'cross':87C 'cross-sit':86C 'enabl':118C 'execut':114C 'file':98C,109C 'finish':102C 'highlight.js':101C 'highlightcod':93C 'html/javascript':111C 'load':103C 'payload':112C 'render':96C 'script':89C 'site':88C 'store':85C 'text':108C 'unescap':97C 'upload':107C 'victim':127C 'viewer':116C 'vulner':90C 'ziplin':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-03-28T06:14:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126945","severity":null,"published_at":"2026-11-13T10:18:01+00:00","modified_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","fetched_at":"2026-11-13T10:47:27+00:00","note":null}],"documents":[{"id":145251,"url":"https://github.com/diced/zipline/security/advisories/GHSA-m649-gvwx-j6qv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-03-28T06:14:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145252,"url":"https://www.vulncheck.com/advisories/zipline-before-4.5.1-stored-xss-via-highlightcode-component","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}