CVE-2026-86644 is a cross-site scripting vulnerability affecting star7th showdoc up to version 3.9.1. The vulnerability is located in the file web_src/public/editor.md/editormd.js within the API Page Save Endpoint component. Remote attackers can exploit this flaw by manipulating input to execute arbitrary scripts. The vendor fixed the issue in version 3.9.2 by setting Mermaid's securityLevel to strict, disabling htmlLabels, and sanitizing rendered SVG content using DOMPurify. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity).

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking or other client-side impacts. The vulnerability requires low attack complexity and no privileges but does require user interaction. There is no indication of elevated privileges or system-level compromise.

Upgrade star7th showdoc to version 3.9.2 or later, which includes the official fix. The vendor's patch enforces stricter security settings and sanitizes SVG content to prevent XSS. No additional mitigations are indicated by the vendor.