XSS Vulnerability in HedgeDoc Markdown Application

CVE-2025-32391

What is CVE-2025-32391?

HedgeDoc, an open-source collaborative markdown notes application, is susceptible to a Cross-Site Scripting (XSS) attack when a malicious SVG file is uploaded. This vulnerability arises specifically when the SVG is opened in a new tab instead of within the editor, leveraging the JSONP capabilities of GitHub Gist embeddings. Vulnerable instances typically utilize the local filesystem upload backend or have specific configurations that serve uploads from the same domain as HedgeDoc. The issue is resolved in version 1.10.3, and administrators are advised to upgrade their installations. For those unable to upgrade immediately, implementing additional security headers, such as Content-Disposition: attachment and Content-Security-Policy: default-src 'none', can mitigate the risk.

References