CVE-2026-41653 is a cross-site scripting vulnerability in the BentoPDF client-side PDF toolkit, specifically affecting versions before 2.8.3. The vulnerability arises from improper neutralization of input during web page generation in the Markdown to PDF tool, allowing execution of arbitrary JavaScript code. This can lead to potential script injection attacks when processing malicious input. The vulnerability has been patched in BentoPDF version 2.8.3. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality with lower impact on integrity and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of the affected application, potentially leading to data exposure or manipulation within the client environment. The impact is rated high due to the ability to execute scripts, which can compromise confidentiality. However, exploitation requires user interaction and does not require privileges or authentication.

Upgrade BentoPDF to version 2.8.3 or later, where this cross-site scripting vulnerability has been patched. Since this is a client-side toolkit and not a cloud service, users must apply the update themselves. No other mitigations are specified or required beyond applying the official fix.