{"id":"CVE-2026-126946","kind":"vulnerability","aliases":["CVE-2026-126946"],"related":[],"title":"Zipline: stored cross-site scripting via embed settings in file pages","description":"Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.","summary":"Zipline versions 4.3.0 before 4.5.0 let a logged-in low-privilege user save embed title, description, site name or color values that are placed unescaped into page meta tags. When another person opens that user's file view page, the injected HTML runs JavaScript in their browser.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Zipline","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["file-sharing","other","self-hosted","zipline"],"not_affected_if":["default-config"],"how_to_check":"- Check the Zipline version: `4.3.0` or later but before `4.5.0` is affected.\n- Review user accounts that can set embed settings through `PATCH /api/user` for unexpected values in embedTitle, embedDescription, embedSiteName or embedColor.","fix":"- Zipline: move to `4.5.0` or later.","status":"open","published_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","triaged_at":"2026-11-13T10:56:51+00:00","updated_at":"2026-11-13T10:56:51+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:56:51Z","model":"claude-haiku-5-5","output":{"fix":"- Zipline: move to `4.5.0` or later.","reach":"internet","title":"Zipline: stored cross-site scripting via embed settings in file pages","impact":"medium","summary":"Zipline versions 4.3.0 before 4.5.0 let a logged-in low-privilege user save embed title, description, site name or color values that are placed unescaped into page meta tags. When another person opens that user's file view page, the injected HTML runs JavaScript in their browser.","audience":"businesses","category":"other","nicknames":[],"who_cares":["zipline","self-hosted","file-sharing"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker's JavaScript runs in visitors' browsers on the Zipline site.","analyst_note":"","how_to_check":"- Check the Zipline version: `4.3.0` or later but before `4.5.0` is affected.\n- Review user accounts that can set embed settings through `PATCH /api/user` for unexpected values in embedTitle, embedDescription, embedSiteName or embedColor.","plain_action":"","product_name":"Zipline","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Self-hosted Zipline instances from 4.3.0 up to but not including 4.5.0 where users can set embed settings. Visitors to file view pages are the victims, so exposure is greatest on instances shared with people outside the admin team. Instances on versions outside that range are not affected by this flaw.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4641,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126946':15A,18A '-2026':14A,17A '/api/user':120C '4.3.0':30B,79C '4.5.0':32B,81C 'allow':91C 'anoth':60B 'attack':108C 'authent':92C 'browser':76B,125C 'color':49B 'contain':82C 'cross':4A,86C 'cross-sit':3A,85C 'cve':13A,16A 'descript':45B 'emb':8A,43B,102C 'embedcolor':116C 'embeddescript':113C 'embedsitenam':114C 'embedtitl':112C 'execut':122C 'file':11A,21B,66B,130C 'file-shar':20B 'host':26B 'html':71B,99C 'inject':70B,98C 'javascript':73B,123C 'let':33B 'log':36B 'logged-in':35B 'low':39B,94C 'low-privileg':38B,93C 'malici':111C 'meta':57B,106C 'name':47B 'open':62B,128C 'page':12A,56B,68B,132C 'patch':119C 'person':61B 'place':53B 'privileg':40B,95C 'run':72B 'save':42B 'script':6A,88C 'self':25B 'self-host':24B 'set':9A,103C,110C 'share':22B 'site':5A,46B,87C 'ssr':105C 'store':2A,84C 'tag':58B,107C 'titl':44B 'unescap':54B,101C 'user':41B,64B,96C 'valu':50B,117C 'version':29B 'via':7A,118C 'view':67B,131C 'visitor':127C 'vulner':89C 'ziplin':1A,27B,28B,77C 'zipline':19A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Zipline instances from 4.3.0 up to but not including 4.5.0 where users can set embed settings. Visitors to file view pages are the victims, so exposure is greatest on instances shared with people outside the admin team. Instances on versions outside that range are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["zipline"],"ptokens":["zipline"],"labels":["filesharing","medium","other","selfhosted","vendor","zipline"],"campaign_type":null,"search_a":"'-126946':15A,18A '-2026':14A,17A 'cross':4A 'cross-sit':3A 'cve':13A,16A 'emb':8A 'file':11A 'page':12A 'script':6A 'set':9A 'site':5A 'store':2A 'via':7A 'ziplin':1A 'zipline':19A","search_b":"'4.3.0':30B '4.5.0':32B 'anoth':60B 'browser':76B 'color':49B 'descript':45B 'emb':43B 'file':21B,66B 'file-shar':20B 'host':26B 'html':71B 'inject':70B 'javascript':73B 'let':33B 'log':36B 'logged-in':35B 'low':39B 'low-privileg':38B 'meta':57B 'name':47B 'open':62B 'page':56B,68B 'person':61B 'place':53B 'privileg':40B 'run':72B 'save':42B 'self':25B 'self-host':24B 'share':22B 'site':46B 'tag':58B 'titl':44B 'unescap':54B 'user':41B,64B 'valu':50B 'version':29B 'view':67B 'ziplin':27B,28B","search_c":"'/api/user':120C '4.3.0':79C '4.5.0':81C 'allow':91C 'attack':108C 'authent':92C 'browser':125C 'contain':82C 'cross':86C 'cross-sit':85C 'emb':102C 'embedcolor':116C 'embeddescript':113C 'embedsitenam':114C 'embedtitl':112C 'execut':122C 'file':130C 'html':99C 'inject':98C 'javascript':123C 'low':94C 'low-privileg':93C 'malici':111C 'meta':106C 'open':128C 'page':132C 'patch':119C 'privileg':95C 'script':88C 'set':103C,110C 'site':87C 'ssr':105C 'store':84C 'tag':107C 'unescap':101C 'user':96C 'valu':117C 'via':118C 'view':131C 'visitor':127C 'vulner':89C 'ziplin':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-03-21T18:51:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126946","severity":null,"published_at":"2026-11-13T10:18:01+00:00","modified_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","fetched_at":"2026-11-13T10:47:27+00:00","note":null}],"documents":[{"id":145253,"url":"https://github.com/diced/zipline/security/advisories/GHSA-9j96-vvqc-h9f8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-03-21T18:51:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145254,"url":"https://www.vulncheck.com/advisories/zipline-4.3.0-before-4.5.0-stored-xss-via-ssr-embed-meta-tags","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}