Executive brief
Outline is a collaborative documentation platform used by teams to share and manage knowledge. A security flaw in the platform's comment section allows users to embed malicious links that, when clicked by another user, can execute unauthorized code in their browser. This could lead to the theft of sensitive session information, unauthorized access to private documents, or the compromise of user accounts within the wiki.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Outline versions 0.84.0 through 1.6.1 due to improper input validation in the comment mention system. The backend fails to sanitize the 'href' attribute for certain mention types (Issue, PullRequest, Project, and URL) within the 'toDOM' function of the Mention node component. An authenticated attacker can bypass the standard UI by sending a crafted API request to '/api/comments.create' containing a 'javascript:' URI. When another user clicks the resulting mention link, the malicious script executes in their browser context. While Content Security Policy (CSP) may mitigate some exploitation, the underlying flaw allows for session hijacking and data exfiltration. The issue is resolved in version 1.7.0 by implementing the 'sanitizeUrl' function.
Affected products
- Outline Outline 0.84.0 to 1.6.1
Timeline
- 2026-04-25: advisory: GitHub security advisory published by maintainers
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix confirmed available in version 1.7.0