Executive brief
ShowDoc is an online documentation and API sharing tool used by technical teams. A stored cross-site scripting (XSS) vulnerability in the Mermaid diagram rendering feature allows authenticated users to inject malicious code into page content, which executes in the browsers of other users who view that documentation. This can lead to theft of session cookies, user credentials, and sensitive project data.
Technical details
The vulnerability is a stored XSS in the Mermaid diagram renderer (editormd.js) triggered through the API Page Save endpoint (/api/page/save). The root cause is a chain of flawed security controls: content is unescaped via unescapeHTML() in page.ts, marked.js is configured with sanitization disabled, and the Mermaid renderer is set to securityLevel: 'loose', which disables URL sanitization and enables unsafe callback execution. An attacker with project editing privileges (including self-registered users) can submit markdown containing a Mermaid code block with embedded JavaScript (e.g., `click A "javascript:prompt(document.cookie)"`). The loose security mode allows this to execute when the diagram is rendered via jQuery's .html() injection. The fix (version 3.9.2, commit a8ea1520) sets Mermaid securityLevel to 'strict', disables htmlLabels, and applies DOMPurify sanitization to the rendered SVG.
Affected products
- star7th ShowDoc 3.7.1 to 3.9.1
Timeline
- 2026-07-27: disclosed: Vulnerability disclosed on GitHub Gist
- 2026-09-08: patched: Fixed in version 3.9.2 with commit a8ea1520; Mermaid securityLevel set to strict, htmlLabels disabled, and SVG sanitized with DOMPurify
- 2026-09-08: advisory: NVD published CVE-2026-86644