# CVE-2026-58487: HedgeDoc stored HTML injection via email local-part

Source: https://junglewise.ai/threats/cve-2026-58487-hedgedoc-stored-html-injection-via-email-local-part  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-58487 · Severity: info · CVSS 5.1 · Published 2026-07-13

HedgeDoc is an open-source collaborative platform used for creating and sharing markdown notes and presentations. A vulnerability in the account registration process allows an attacker to create an account with a malicious email address that injects unauthorized content into the platform. This could be used to deface shared notes, mislead users with fake information, or embed external content like unauthorized frames into collaborative sessions.

Technologies: [HedgeDoc](https://junglewise.ai/threats/technologies/hedgedoc). Vendors: [HedgeDoc](https://junglewise.ai/threats/vendors/hedgedoc).

## Quick answers

**Is CVE-2026-58487 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58487 being exploited in the wild.

**How severe is CVE-2026-58487?** Informational severity, with a CVSS score of 5.1, published 13 July 2026.

**Which products and versions are affected?** HedgeDoc < 1.11.0.

**Is there a fix for CVE-2026-58487?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58487 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58487?** Check whether you run HedgeDoc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

HedgeDoc versions prior to 1.11.0 are vulnerable to stored HTML injection due to improper neutralization of the local-part of email addresses during registration. The application accepted RFC 5321 quoted-string local-parts and subsequently reused them as the user's display name without proper escaping. This allowed an authenticated attacker to inject arbitrary HTML markup into publish views, slide views, and the collaborative editor. While a Content Security Policy (CSP) mitigated direct inline JavaScript execution (XSS), attackers could still modify page content and embed cross-origin iframes. The issue is resolved in version 1.11.0 by escaping user-derived display names before rendering.

## Affected products

- HedgeDoc HedgeDoc < 1.11.0

## Timeline

- 2026-06-18: advisory: GitHub Security Advisory published by maintainers
- 2026-07-13: disclosed: CVE published to NVD

## References

- [https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6c2w-8w96-3pcv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6c2w-8w96-3pcv)

## Related threats

- [HedgeDoc permission handler improper validation](https://junglewise.ai/threats/cve-2026-102927-hedgedoc-is-an-open-source-real-time-collaborative-markdown)
- [HedgeDoc CSRF in GitHub Gist export callback](https://junglewise.ai/threats/cve-2026-58489-hedgedoc-csrf-in-github-gist-export-callback)
- [HedgeDoc denial of service via YAML alias bomb in note frontmatter](https://junglewise.ai/threats/cve-2026-58486-hedgedoc-denial-of-service-via-yaml-alias-bomb-in-note)
- [HedgeDoc rate-limit bypass via CF-Connecting-IP spoofing](https://junglewise.ai/threats/cve-2026-58488-hedgedoc-rate-limit-bypass-via-cf-connecting-ip-spoofing)
- [HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's…](https://junglewise.ai/threats/cve-2025-66629-hedgedoc-is-an-open-source-real-time-collaborative-markdown-notes)