{"id":"CVE-2026-129170","kind":"vulnerability","aliases":["CVE-2026-129170"],"related":[],"title":"FileCodeBox: stored script injection through Markdown preview steals admin token","description":"FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage.","summary":"FileCodeBox, a file and text sharing app, returns unsanitized text from its Markdown preview when the parser fails, so shared content can carry HTML. An unauthenticated attacker can run script in a visitor's browser that reads the admin token from localStorage.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FileCodeBox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["filecodebox","other","self-hosted"],"not_affected_if":["no-markdown-preview","version-outside-range"],"how_to_check":"- Check the FileCodeBox version the instance runs; versions 2.2.1 through 2.8.4 are listed as affected.\n- Look for a Markdown preview of shared text on the instance (renderMarkdownPreview is the affected function).","fix":"- Move to a version later than `2.8.4`; the sources do not name the exact fixed release. Patch linked from the NVD record: github.com.","status":"open","published_at":"2026-11-13T18:17:42+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","triaged_at":"2026-11-13T18:51:44+00:00","updated_at":"2026-11-13T18:51:44+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T18:51:44Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `2.8.4`; the sources do not name the exact fixed release. Patch linked from the NVD record: github.com.","reach":"internet","title":"FileCodeBox: stored script injection through Markdown preview steals admin token","impact":"high","summary":"FileCodeBox, a file and text sharing app, returns unsanitized text from its Markdown preview when the parser fails, so shared content can carry HTML. An unauthenticated attacker can run script in a visitor's browser that reads the admin token from localStorage.","audience":"businesses","category":"other","nicknames":[],"who_cares":["filecodebox","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"admin token stolen, attacker gets admin control of the instance","analyst_note":"Confirm the exact fixed version and whether the preview is on by default, via the github.com patch link and the vulncheck advisory.","how_to_check":"- Check the FileCodeBox version the instance runs; versions 2.2.1 through 2.8.4 are listed as affected.\n- Look for a Markdown preview of shared text on the instance (renderMarkdownPreview is the affected function).","plain_action":"","product_name":"FileCodeBox","needs_analyst":true,"not_affected_if":["version-outside-range","no-markdown-preview"],"who_is_affected":"Teams that self-host FileCodeBox between versions 2.2.1 and 2.8.4 and let people share text that is rendered as Markdown preview. The admin token sits in localStorage, so an admin who opens a poisoned share page is the main exposure. Instances on versions outside that range, or with the preview not in use, can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000782,"input_tokens":4624,"output_tokens":639,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129170':13A,16A '-2026':12A,15A '2.2.1':66C '2.8.4':68C 'admin':9A,61B,108C 'app':29B 'attack':49B,89C 'blockquot':97C 'browser':57B 'carri':45B 'contain':69C 'content':43B 'cross':73C 'cross-sit':72C 'cve':11A,14A 'execut':103C 'fail':40B 'file':25B 'filecodebox':1A,17A,18B,23B,65C 'follow':99C 'host':22B 'html':46B,101C 'inject':4A 'localstorag':64B,111C 'mark':85C 'markdown':6A,35B 'marker':98C 'nest':96C 'parser':39B,86C 'payload':102C 'preview':7A,36B 'read':59B 'rendermarkdownpreview':78C 'return':30B,80C 'run':51B 'script':3A,52B,75C,104C 'self':21B 'self-host':20B 'share':28B,42B,91C 'site':74C 'steal':8A,106C 'store':2A,71C 'text':27B,32B,82C,92C 'thousand':94C 'throw':87C 'token':10A,62B,109C 'unauthent':48B,88C 'unsanit':31B,81C 'visitor':55B 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host FileCodeBox between versions 2.2.1 and 2.8.4 and let people share text that is rendered as Markdown preview. The admin token sits in localStorage, so an admin who opens a poisoned share page is the main exposure. Instances on versions outside that range, or with the preview not in use, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["filecodebox"],"ptokens":["filecodebox"],"labels":["filecodebox","medium","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-129170':13A,16A '-2026':12A,15A 'admin':9A 'cve':11A,14A 'filecodebox':1A,17A 'inject':4A 'markdown':6A 'preview':7A 'script':3A 'steal':8A 'store':2A 'token':10A","search_b":"'admin':61B 'app':29B 'attack':49B 'browser':57B 'carri':45B 'content':43B 'fail':40B 'file':25B 'filecodebox':18B,23B 'host':22B 'html':46B 'localstorag':64B 'markdown':35B 'parser':39B 'preview':36B 'read':59B 'return':30B 'run':51B 'script':52B 'self':21B 'self-host':20B 'share':28B,42B 'text':27B,32B 'token':62B 'unauthent':48B 'unsanit':31B 'visitor':55B","search_c":"'2.2.1':66C '2.8.4':68C 'admin':108C 'attack':89C 'blockquot':97C 'contain':69C 'cross':73C 'cross-sit':72C 'execut':103C 'filecodebox':65C 'follow':99C 'html':101C 'localstorag':111C 'mark':85C 'marker':98C 'nest':96C 'parser':86C 'payload':102C 'rendermarkdownpreview':78C 'return':80C 'script':75C,104C 'share':91C 'site':74C 'steal':106C 'store':71C 'text':82C,92C 'thousand':94C 'throw':87C 'token':109C 'unauthent':88C 'unsanit':81C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129170","severity":null,"published_at":"2026-11-13T18:17:42+00:00","modified_at":"2026-11-13T18:17:42+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","fetched_at":"2026-11-13T18:49:31+00:00","note":null}],"documents":[{"id":148628,"url":"https://github.com/vastsa/FileCodeBoxFronted/commit/4c40406d366af1583a3ba2327366b7a62d765537","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148629,"url":"https://www.vulncheck.com/advisories/filecodebox-2.2.1-through-2.8.4-stored-xss-via-markdown-preview-parser-error","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}