The vulnerability CVE-2026-40201 affects @diplodoc/search-extension versions 1.0.0 through 3.x before 3.0.3. It is a stored cross-site scripting (CWE-79) issue where the title in a markdown (.md) file is not properly sanitized before being rendered in a web page, allowing injection of malicious scripts. The CVSS 3.1 base score is 5.4 (medium), with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts on confidentiality and integrity in a scope-changing manner. No patch or official remediation level is provided in the available data.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited disclosure or modification of information accessible to the user. The vulnerability does not impact system availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when processing or rendering untrusted markdown files with titles, and consider applying manual input sanitization or disabling features that render markdown titles if feasible.