---
id: "CVE-2026-129170"
page: "https://infrastack.ai/live/CVE-2026-129170"
kind: "vulnerability"
aliases: ["CVE-2026-129170"]
title: "FileCodeBox: stored script injection through Markdown preview steals admin token"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "FileCodeBox", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["filecodebox", "other", "self-hosted"]
not_affected_if: ["no-markdown-preview", "version-outside-range"]
published_at: "2026-11-13T18:17:42+00:00"
first_seen_at: "2026-11-13T18:49:31+00:00"
updated_at: "2026-11-13T18:51:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129170", "first_seen_at": "2026-11-13T18:49:31+00:00"}]
exploit_sources: []
---

# FileCodeBox: stored script injection through Markdown preview steals admin token

Link for people: https://infrastack.ai/live/CVE-2026-129170 (this .md is for agents)

FileCodeBox, a file and text sharing app, returns unsanitized text from its Markdown preview when the parser fails, so shared content can carry HTML. An unauthenticated attacker can run script in a visitor's browser that reads the admin token from localStorage.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FileCodeBox affected range not listed fixed no fixed version listed

## How to check

- Check the FileCodeBox version the instance runs; versions 2.2.1 through 2.8.4 are listed as affected.
- Look for a Markdown preview of shared text on the instance (renderMarkdownPreview is the affected function).

## Fix

- Move to a version later than `2.8.4`; the sources do not name the exact fixed release. Patch linked from the NVD record: github.com.

## Timeline

- 2026-11-13T18:49:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129170

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/filecodebox-2.2.1-through-2.8.4-stored-xss-via-markdown-preview-parser-error
- [fix] Patch: github.com https://github.com/vastsa/FileCodeBoxFronted/commit/4c40406d366af1583a3ba2327366b7a62d765537

## From the sources

FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_