@diplodoc/search-extension allows stored XSS via Markdown file title

Description

@diplodoc/search-extension 1.0.0 through 3.0.2 allows stored XSS via .md file title.

Recommendation

Update the @diplodoc/search-extension package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.0, < 3.0.5
• Patched version(s): 3.0.5

References

• GHSA-rjmp-rwj4-mv82
• CVE-2026-40201
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft - CVE-2026-46496
• Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - CVE-2026-46396
• Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player - CVE-2026-46396
• Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order - CVE-2026-45665

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Tags:

npm

@diplodoc/search-extension