Quick answers
- Is CVE-2026-58487 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-58487 being exploited in the wild.
- How severe is CVE-2026-58487?
- Informational severity, with a CVSS score of 5.1, published 13 July 2026.
- Which products and versions are affected?
- HedgeDoc < 1.11.0.
- Is there a fix for CVE-2026-58487?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-58487 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-58487?
- Check whether you run HedgeDoc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
HedgeDoc versions prior to 1.11.0 are vulnerable to stored HTML injection due to improper neutralization of the local-part of email addresses during registration. The application accepted RFC 5321 quoted-string local-parts and subsequently reused them as the user's display name without proper escaping. This allowed an authenticated attacker to inject arbitrary HTML markup into publish views, slide views, and the collaborative editor. While a Content Security Policy (CSP) mitigated direct inline JavaScript execution (XSS), attackers could still modify page content and embed cross-origin iframes. The issue is resolved in version 1.11.0 by escaping user-derived display names before rendering.
Affected products
- HedgeDoc HedgeDoc < 1.11.0
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published by maintainers
- 2026-07-13: disclosed: CVE published to NVD