Stored XSS Vulnerability in Docmost Wiki Software

CVE-2026-23630

What is CVE-2026-23630?

Docmost, an open-source collaborative wiki and documentation software, is susceptible to a stored Cross-Site Scripting vulnerability in versions 0.3.0 through 0.23.2. The flaw occurs when attacker-controlled Mermaid code blocks are rendered using the mermaid.render() function, which subsequently inserts the resulting SVG/HTML into the Document Object Model (DOM) through dangerouslySetInnerHTML without proper sanitization measures. This vulnerability allows the exploitation of Mermaid's per-diagram %%{init}%% directives to manipulate security parameters, enabling the execution of arbitrary HTML and JavaScript within the context of the victim's browser. Users are strongly advised to upgrade to version 0.24.0 to mitigate this risk.

References