---
id: "CVE-2026-126946"
page: "https://infrastack.ai/live/CVE-2026-126946"
kind: "vulnerability"
aliases: ["CVE-2026-126946"]
title: "Zipline: stored cross-site scripting via embed settings in file pages"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Zipline", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["file-sharing", "other", "self-hosted", "zipline"]
not_affected_if: ["default-config"]
published_at: "2026-11-13T10:18:01+00:00"
first_seen_at: "2026-11-13T10:47:27+00:00"
updated_at: "2026-11-13T10:56:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126946", "first_seen_at": "2026-11-13T10:47:27+00:00"}]
exploit_sources: []
---

# Zipline: stored cross-site scripting via embed settings in file pages

Link for people: https://infrastack.ai/live/CVE-2026-126946 (this .md is for agents)

Zipline versions 4.3.0 before 4.5.0 let a logged-in low-privilege user save embed title, description, site name or color values that are placed unescaped into page meta tags. When another person opens that user's file view page, the injected HTML runs JavaScript in their browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zipline affected range not listed fixed no fixed version listed

## How to check

- Check the Zipline version: `4.3.0` or later but before `4.5.0` is affected.
- Review user accounts that can set embed settings through `PATCH /api/user` for unexpected values in embedTitle, embedDescription, embedSiteName or embedColor.

## Fix

- Zipline: move to `4.5.0` or later.

## Timeline

- 2026-11-13T10:47:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126946

## Documents

- [advisory] Vendor advisory: github.com https://github.com/diced/zipline/security/advisories/GHSA-9j96-vvqc-h9f8
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zipline-4.3.0-before-4.5.0-stored-xss-via-ssr-embed-meta-tags

## From the sources

Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_