Stored Cross-Site Scripting in Otter Wiki by Redimp
CVE-2026-120500

5.3MEDIUM

Key Information:

Vendor

Redimp

Status
Otterwiki
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120500?

Otter Wiki prior to version 2.26.2 is vulnerable to a stored cross-site scripting (XSS) issue in the OtterwikiMdRenderer.block_code function. This vulnerability arises due to the application's failure to properly escape user input within math fenced code blocks. As a result, attackers can exploit this flaw to inject arbitrary JavaScript or HTML content. Anyone with editing capabilities, including anonymous users in default configurations, can place malicious scripts that execute whenever visitors view the affected pages, significantly compromising the security and integrity of user data.

Affected Version(s)

otterwiki 2.0.0 < 2.26.2

References

https://github.com/redimp/otterwiki/commit/b2e91d20ed36c0...
patch
https://github.com/redimp/otterwiki/releases/tag/v2.26.2
release-notes
https://www.vulncheck.com/advisories/an-otter-wiki-before...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
Ralph Thesen
.