Stored Cross-Site Scripting in Mbin Product by MbinOrg
CVE-2026-126569

5.1MEDIUM

Key Information:

Vendor

Mbinorg

Status
Mbin
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126569?

The Mbin product version 1.2.1 and earlier versions contain a stored cross-site scripting vulnerability in the EmbedElement::buildDestructed() function. The issue arises due to inadequate HTML escaping of nested Markdown image alt text and URL, allowing authenticated users to embed malicious HTML within images linked in posts, comments, or bios. This flaw can lead to the execution of arbitrary scripts in users' browsers, posing a significant risk to website visitors.

Affected Version(s)

mbin 1.2.1 < 1.11.1

mbin 1.11.1

References

https://github.com/MbinOrg/mbin/security/advisories/GHSA-...
vendor-advisory
https://github.com/MbinOrg/mbin/commit/736fd39fe9cd59f5d5...
patch
https://github.com/MbinOrg/mbin/releases/tag/v1.11.1
release-notes

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.