Executive brief
md-fileserver is a utility for viewing Markdown files in a browser. The application renders user-supplied Markdown content with raw HTML enabled, allowing attackers to embed malicious JavaScript that executes in visitors' browsers without authentication. An attacker can steal session tokens, take over accounts, deface content, or exfiltrate sensitive data from any user viewing a crafted Markdown file.
Technical details
The vulnerability stems from md-fileserver's configuration in config.js that explicitly enables raw HTML rendering (markdownIt: { html: true }) combined with unsanitized output injection in lib/markd.js and the template.html file. The Markdown renderer processes user-controlled content without sanitizing HTML tags or attributes, and the rendered output is injected directly into the HTML template using <%= markdown %> without encoding. An unauthenticated attacker can craft a Markdown file containing script tags or event handlers (e.g., onload, onerror) that execute arbitrary JavaScript in any browser viewing the content, with no user interaction required beyond viewing the file. Successful exploitation enables session hijacking, credential theft, CSRF token exfiltration, content defacement, and unauthorized API access. The vulnerability affects all versions prior to 1.10.3, which is available as a patch.
Affected products
- commenthol md-fileserver < 1.10.3
Timeline
- 2026-05-14: disclosed
- 2026-05-21: patched: Version 1.10.3 released