Executive brief
wastebin is a self-hosted code-sharing service. A security flaw in how it handles very long lines of text allows an attacker to inject malicious HTML or scripts into a shared snippet. If a user views a specially crafted snippet, the attacker could potentially manipulate the page content or attempt to perform actions on the user's behalf, depending on the browser's security settings.
Technical details
An HTML injection vulnerability exists in the syntax highlighting component (`/src/highlight.rs`) of wastebin v3.4.1. The highlighter implements a fallback mechanism for lines exceeding a 2048-character threshold; this fallback returns the raw string instead of an escaped representation. When the formatted paste template renders this output, it treats the unescaped string as trusted HTML. An attacker can exploit this by creating a paste with a line longer than 2048 characters containing HTML metacharacters or script tags. While the default Content Security Policy (CSP) may mitigate some script execution, the vulnerability allows for persistent HTML injection in the rendered DOM.
Affected products
- matze wastebin 3.4.1
Timeline
- 2026-06-13: disclosed: Vulnerability details shared via GitHub Gist.
- 2026-06-15: advisory: CVE-2026-50883 published.