FILECODEBOX · CVE-2026-129170 · Other
NO FIX YET · SEE WHAT TO DO
FileCodeBox, a file and text sharing app, returns unsanitized text from its Markdown preview when the parser fails, so shared content can carry HTML. An unauthenticated attacker can run script in a visitor's browser that reads the admin token from localStorage.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host FileCodeBox between versions 2.2.1 and 2.8.4 and let people share text that is rendered as Markdown preview. The admin token sits in localStorage, so an admin who opens a poisoned share page is the main exposure. Instances on versions outside that range, or with the preview not in use, can skip it.
Not affected if no-markdown-preview, version-outside-range
Who cares filecodebox, self-hosted
2.8.4; the sources do not name the exact fixed release. Patch linked from the NVD record: github.com.FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.