Threats tagged 'ghsa-2fv3-2f7j-2vq4'

Otter Wiki versions prior to 2.26.2 contain a stored cross-site scripting (XSS) vulnerability in the OtterwikiMdRenderer.block_code component. This flaw allows attackers with page editing permissions, including anonymous users under default settings, to inject arbitrary scripts by placing HTML inside math fenced code blocks. The injected scripts are rendered unescaped and execute for every viewer of the affected page.