Executive brief
LeafWiki is a self-hosted wiki application that allows users to create and share wiki pages. Prior to version 0.10.2, a user with editor permissions could inject malicious HTML/JavaScript code into a page title. When other users searched for matching terms, this code could execute in their browsers, potentially allowing attackers to perform unauthorized actions or steal session data. On publicly-accessible deployments, this vulnerability could affect unauthenticated visitors.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the search results display functionality. The root cause is that page titles returned by the search API are rendered as raw HTML using dangerouslySetInnerHTML without proper sanitization. An attacker with editor or administrator permissions can create or modify a page title containing HTML/JavaScript payload. When another user searches for a term matching the malicious title, the payload executes in the victim's browser context with the victim's permissions. The vulnerability is patched in version 0.10.2 by ensuring author-controlled page titles are properly escaped before rendering while preserving search result highlighting.
Affected products
- LeafWiki LeafWiki prior to 0.10.2
Timeline
- 2026-06-05: disclosed: GitHub Security Advisory GHSA-j344-qxqm-wg64 published
- 2026-08-21: disclosed: CVE-2026-53529 published to NVD
- 2026: patched: Fixed in version 0.10.2