Stored XSS in Search Extension Product by Diplodoc

CVE-2026-40201

What is CVE-2026-40201?

The Diplodoc Search Extension, versions 1.0.0 through 3.x (prior to 3.0.3), is vulnerable to stored Cross-Site Scripting (XSS) attacks. This vulnerability allows attackers to inject malicious scripts via the title field in .md files. When these files are processed and displayed, the injected scripts can be executed in the user's browser context, potentially compromising user data and session security. Users are advised to upgrade to version 3.0.3 or later to mitigate this risk.

References