Remark42's image proxy fetches remote URLs and determines if the resource is an image by inspecting only the Content-Type header from the remote server during download, without verifying the actual content bytes. When serving the resource, it uses http.DetectContentType to sniff the bytes and sets the response Content-Type accordingly. This mismatch allows an attacker to serve a resource with a spoofed Content-Type header (e.g., image/png) but actual HTML/JavaScript content. The proxy accepts it as an image during download but serves it as text/html, enabling cross-site scripting within Remark42's origin. No authentication is required to exploit this vulnerability. The issue affects Remark42 versions 1.6.0 through 1.15.0 and is resolved in 1.16.0.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the Remark42 origin, potentially leading to session hijacking, defacement, or other actions limited by the browser's same-origin policy. The vulnerability requires no privileges on the target instance and can be triggered by delivering a malicious proxy URL to victims. The CVSS score of 8.2 reflects high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

Upgrade Remark42 to version 1.16.0 or later, where this vulnerability has been fixed. Patch status is confirmed by the vendor advisory stating the issue is resolved in 1.16.0. Until upgrading, avoid clicking or distributing untrusted proxy URLs that fetch remote content through Remark42's image proxy.