CVE-2026-23630

CVE-2026-23630 is a unknown severity vulnerability affecting the affected product.

Description: Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, […]

Affected Versions:
❌ Vulnerable: 0.3.0 - 0.23.2
✅ Safe: ≥ 0.23.3

Exploit Difficulty: HARD
⏱️ Time to exploit: > 4 hours
🛠️ Required skills: Advanced security expertise
💰 Public exploits: Rare or not public

How to Fix:


- Check if you're running the affected product
- Verify version (vulnerable: 0.3.0 - 0.23.2)


- Update to ≥ 0.23.3 or later
- If patching is not immediately possible: restrict network exposure, apply least-privilege access


- Test the fix in a staging environment first
- Review logs for signs of exploitation
- Monitor for IOCs (Indicators of Compromise)


- Enable automatic security updates
- Set up vulnerability monitoring
- Review and harden security configurations