CVE-2026-23630: Docmost Mermaid Stored XSS Vulnerability

CVE-2026-23630 Overview

CVE-2026-23630 is a stored Cross-Site Scripting (XSS) vulnerability affecting Docmost, an open-source collaborative wiki and documentation software. The vulnerability exists in the Mermaid code block rendering functionality, where attacker-controlled Mermaid diagrams can be rendered using mermaid.render() and subsequently injected into the DOM via dangerouslySetInnerHTML without proper sanitization. This allows attackers to leverage Mermaid's per-diagram %%{init}%% directives to override the securityLevel configuration and enable htmlLabels, ultimately permitting arbitrary HTML and JavaScript execution for any user viewing the malicious content.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the browsers of any user viewing the affected wiki page, potentially leading to session hijacking, credential theft, or further compromise of collaborative documentation environments.

Affected Products

• Docmost versions 0.3.0 through 0.23.2

Discovery Timeline

• 2026-01-21 - CVE CVE-2026-23630 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-23630

Vulnerability Analysis

This stored XSS vulnerability resides in the Mermaid diagram rendering pipeline within Docmost's frontend application. When users create or edit wiki pages containing Mermaid code blocks, the application processes these diagrams client-side using the Mermaid library's render() function. The resulting SVG/HTML output is then inserted directly into the page DOM using React's dangerouslySetInnerHTML property without any sanitization step.

The attack exploits Mermaid's directive system, which allows per-diagram configuration overrides through %%{init}%% blocks at the beginning of diagram definitions. An attacker can craft a malicious Mermaid diagram that sets securityLevel: 'loose' and htmlLabels: true, effectively disabling the library's built-in XSS protections. This configuration allows arbitrary HTML content within diagram labels, including <script> tags and event handlers that execute JavaScript when the diagram is rendered.

Because the malicious payload is stored in the wiki content, every user who views the affected page will have the malicious script executed in their browser context, making this a particularly dangerous vulnerability in collaborative environments.

Root Cause

The root cause is the absence of output sanitization when rendering user-controlled Mermaid diagrams. The application relies solely on Mermaid's internal security settings, which can be overridden by users through inline directives. The use of dangerouslySetInnerHTML without passing the content through a sanitization library like DOMPurify creates a direct path for XSS payloads to reach the DOM.

Attack Vector

The attack is network-based and requires low-privilege authenticated access to create or edit wiki content. An attacker creates a wiki page containing a specially crafted Mermaid diagram with malicious %%{init}%% directives that override security settings. When any authenticated user views this page, the unsanitized SVG/HTML output is rendered in their browser, executing the attacker's JavaScript payload with full access to the victim's session context.

The following patch demonstrates the fix implemented in version 0.24.0, which introduces DOMPurify sanitization:

 import classes from "./code-block.module.css";
 import { useTranslation } from "react-i18next";
 import { useComputedColorScheme } from "@mantine/core";
+import DOMPurify from "dompurify";
 
 interface MermaidViewProps {
   props: NodeViewProps;

Source: GitHub Commit cb9f27da9a8b4940760e37e5238a1eb91e427daf

Detection Methods for CVE-2026-23630

Indicators of Compromise

• Wiki pages containing Mermaid code blocks with %%{init}%% directives that set securityLevel to loose or enable htmlLabels
• Mermaid diagrams containing suspicious HTML elements such as <script>, <iframe>, or event handler attributes like onload, onerror, or onclick
• Unusual JavaScript execution patterns or network requests originating from wiki page views

Detection Strategies

• Implement content scanning rules to detect Mermaid diagrams containing %%{init}%% directives with security-weakening configurations
• Monitor for JavaScript execution attempts within SVG elements rendered on wiki pages
• Review web application firewall logs for requests containing potential XSS payloads in wiki content submissions
• Audit user-generated content for patterns consistent with XSS injection attempts in Mermaid syntax

Monitoring Recommendations

• Enable browser-based Content Security Policy (CSP) reporting to detect inline script execution attempts
• Configure application logging to capture wiki content modifications, particularly those involving code blocks
• Implement real-time alerting for wiki pages containing known malicious patterns in Mermaid diagrams

How to Mitigate CVE-2026-23630

Immediate Actions Required

• Upgrade Docmost to version 0.24.0 or later immediately
• Audit existing wiki content for potentially malicious Mermaid diagrams containing %%{init}%% directives
• Consider temporarily disabling Mermaid rendering if immediate upgrade is not possible
• Review access logs to identify any suspicious content modifications prior to patching

Patch Information

The vulnerability has been addressed in Docmost version 0.24.0. The fix introduces DOMPurify sanitization of Mermaid-rendered output before DOM insertion, preventing malicious HTML and JavaScript from executing. Organizations should upgrade to version 0.24.0 or later as documented in the GitHub Release v0.24.0 and the GitHub Security Advisory GHSA-r4hj-mc62-jmwj.

Workarounds

• Implement a Content Security Policy (CSP) header that restricts inline script execution using script-src 'self' to limit XSS impact
• Restrict wiki edit permissions to trusted users until the patch can be applied
• Deploy a web application firewall rule to block submissions containing Mermaid %%{init}%% directives with securityLevel or htmlLabels modifications
• Consider using a reverse proxy to sanitize HTML content before delivery to end users

# Example Content Security Policy header configuration for Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none';" always;