CVE-2026-46492 is a high-severity vulnerability affecting commenthol's md-fileserver before version 1.10.3. The issue arises because the Markdown rendering logic improperly neutralizes script-related HTML tags, specifically allowing embedded raw HTML such as <script> tags to be processed and injected into the rendered page without sanitization. This enables an attacker to execute arbitrary JavaScript in the security context of the affected domain, constituting a classic cross-site scripting (XSS) flaw. The vulnerability has been addressed by the vendor in version 1.10.3.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of the affected domain, potentially leading to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not affect availability and requires no privileges or user interaction to exploit.

Upgrade md-fileserver to version 1.10.3 or later, where this XSS vulnerability has been patched. No other vendor advisories or temporary mitigations are provided. Patch status is confirmed by the vendor's versioning information.