CVE-2026-24127

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24127", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.473Z", "datePublished": "2026-01-23T23:01:15.832Z", "dateUpdated": "2026-01-26T16:18:10.770Z"}, "containers": {"cna": {"title": "Typemill has Reflected XSS via login error view template", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr"}, {"name": "https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c", "tags": ["x_refsource_MISC"], "url": "https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c"}, {"name": "https://github.com/typemill/typemill/releases/tag/v2.19.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/typemill/typemill/releases/tag/v2.19.2"}], "affected": [{"vendor": "typemill", "product": "typemill", "versions": [{"version": "< v2.19.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-23T23:01:15.832Z"}, "descriptions": [{"lang": "en", "value": "Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2."}], "source": {"advisory": "GHSA-65x4-pjhj-r8wr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T16:14:37.675485Z", "id": "CVE-2026-24127", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T16:18:10.770Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24127", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.473Z", "datePublished": "2026-01-23T23:01:15.832Z", "dateUpdated": "2026-01-26T16:18:10.770Z"}, "containers": {"cna": {"title": "Typemill has Reflected XSS via login error view template", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr"}, {"name": "https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c", "tags": ["x_refsource_MISC"], "url": "https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c"}, {"name": "https://github.com/typemill/typemill/releases/tag/v2.19.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/typemill/typemill/releases/tag/v2.19.2"}], "affected": [{"vendor": "typemill", "product": "typemill", "versions": [{"version": "< v2.19.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-23T23:01:15.832Z"}, "descriptions": [{"lang": "en", "value": "Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2."}], "source": {"advisory": "GHSA-65x4-pjhj-r8wr", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24127", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T16:14:37.675485Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T16:14:38.702Z"}}]}}

{"affected": [{"affectedData": [{"product": "typemill", "vendor": "typemill", "versions": [{"status": "affected", "version": "< v2.19.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typemill:typemill:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E3CADA3-5037-4F37-9488-CE162A458090", "versionEndExcluding": "2.19.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2."}, {"lang": "es", "value": "Typemill es un CMS de archivo plano, basado en Markdown, dise\u00f1ado para sitios web de documentaci\u00f3n informativa. Un Cross-Site Scripting (XSS) reflejado existe en la plantilla de vista de error de inicio de sesi\u00f3n 'login.twig' de las versiones 2.19.1 e inferiores. El valor 'username' puede ser devuelto sin la codificaci\u00f3n contextual adecuada cuando la autenticaci\u00f3n falla. Un atacante puede ejecutar scripts en el contexto de la p\u00e1gina de inicio de sesi\u00f3n. Este problema ha sido solucionado en la versi\u00f3n 2.19.2."}], "id": "CVE-2026-24127", "lastModified": "2026-06-17T10:22:40.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24127", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T16:14:37.675485Z", "version": "2.0.3"}}]}, "published": "2026-01-23T23:15:54.360", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/typemill/typemill/releases/tag/v2.19.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:10:02.145926+00:00", "value": {"mitigation_remediation": ["Upgrade Typemill to version 2.19.2 or later to apply the vendor fix.", "If an upgrade is delayed, modify the login error template to escape the username output (e.g., use Twig\u2019s `{{ username|e('html') }}`) or remove the username echo entirely.", "Limit exposure by restricting access to the login page so that only trusted users can trigger the error view."], "summary": {"action": "Patch Update", "impact": "Reflected XSS via the login error page"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Typemill flat\u2011file CMS from vendor Typemill. Versions 2.19.1 and older are vulnerable; the issue was remedied in release 2.19.2.", "description_and_impact": "A reflected Cross\u2011Site Scripting flaw allows an attacker to inject and execute arbitrary JavaScript when a login attempt fails, because the supplied username is echoed back without proper encoding. The impact includes theft of session cookies, defacement, or redirection of the victim to malicious sites.", "risk_and_exploitability": "The CVSS score of 5.4 indicates moderate severity. EPSS shows an exploit likelihood of less than 1\u202f%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that the attacker crafts a link to the login page with a malicious username that will be reflected back, or sends phishing emails prompting the victim to log in. Based on the description, the attacker can only target users who visit the vulnerable login page after a failed authentication attempt, thus requiring the victim to be prompted to enter credentials. Because it is a reflected XSS, the exploit is limited to browsers executing the injected script in the context of the login page and cannot affect other users or the server."}}}}, "created": "2026-01-26T11:49:00.857838+00:00", "updated": "2026-04-18T15:15:03.694844+00:00", "vendors": ["typemill", "typemill$PRODUCT$typemill"]}