CVE-2026-40201: Diplodoc Search Extension XSS Vulnerability

CVE-2026-40201 Overview

CVE-2026-40201 is a stored cross-site scripting (XSS) vulnerability in the @diplodoc/search-extension package. The flaw affects versions 1.0.0 through 3.x before 3.0.3. Attackers can inject malicious script payloads through the title field of a Markdown (.md) file. When other users view the rendered documentation, the injected script executes in their browser context.

The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Exploitation requires authenticated access with privileges to commit Markdown content and user interaction to trigger the payload.

Critical Impact

Authenticated attackers can persist JavaScript payloads in documentation titles, enabling session theft, credential phishing, and unauthorized actions against viewers of affected Diplodoc-rendered content.

Affected Products

• @diplodoc/search-extension versions 1.0.0 through 2.x
• @diplodoc/search-extension versions 3.0.0 through 3.0.2
• Diplodoc documentation platforms embedding the vulnerable search extension

Discovery Timeline

• 2026-05-01 - CVE-2026-40201 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-40201

Vulnerability Analysis

The @diplodoc/search-extension package indexes Markdown documents and exposes their metadata, including the document title, through the search interface. The extension fails to properly neutralize HTML and JavaScript content embedded in the title field before rendering it into search results or related UI components.

When a Markdown file contains a crafted title value with embedded HTML or script tags, the unsanitized string reaches the Document Object Model (DOM). The browser parses the injected markup as executable script rather than literal text. This results in stored XSS, as the malicious payload persists in the indexed search data and triggers each time a user interacts with the affected search results.

Root Cause

The root cause is missing output encoding when rendering Markdown title metadata into the search UI. The extension trusts the title field as plain text but inserts it into HTML contexts without escaping characters such as <, >, and ". The fix in version 3.0.3 introduces proper sanitization of title values before rendering.

Attack Vector

An attacker with permission to author or modify Markdown files in a Diplodoc-based documentation repository injects a malicious payload into the front-matter title field. The payload is indexed by the search extension. When a victim performs a search or navigates documentation that surfaces the affected title, the script executes in the victim's browser under the origin of the documentation site.

Because the scope is changed (S:C), the executed script can access resources beyond the vulnerable component's security context. Successful exploitation can lead to session token theft, drive-by redirects, and unauthorized actions performed as the victim.

Detailed remediation context is available in the GitHub Pull Request and the v3.0.3 release notes.

Detection Methods for CVE-2026-40201

Indicators of Compromise

• Markdown files containing title front-matter values with HTML tags such as <script>, <img onerror=>, or <svg onload=>.
• Search index entries or generated HTML containing unescaped angle brackets within title fields.
• Browser console errors or unexpected outbound requests originating from documentation pages after rendering search results.

Detection Strategies

• Audit all .md files in documentation repositories for non-alphanumeric characters in title front-matter, focusing on <, >, ", and '.
• Review the deployed @diplodoc/search-extension version in package.json and package-lock.json to confirm whether it falls within the vulnerable range.
• Inspect web server and CDN logs for unusual referrers or outbound calls triggered by documentation page loads.

Monitoring Recommendations

• Enable a strict Content Security Policy (CSP) on documentation sites and monitor report-uri or report-to endpoints for violation reports indicating injected scripts.
• Continuously scan source repositories with software composition analysis (SCA) tooling to detect vulnerable Diplodoc dependencies.
• Log and alert on anomalous authentication events from accounts that view documentation, which may indicate session token exfiltration.

How to Mitigate CVE-2026-40201

Immediate Actions Required

• Upgrade @diplodoc/search-extension to version 3.0.3 or later across all build pipelines and deployed documentation sites.
• Rebuild and redeploy any documentation artifacts produced with vulnerable versions to flush the existing search index.
• Review recent commits to documentation repositories for suspicious modifications to Markdown title fields.

Patch Information

The maintainers fixed the vulnerability in @diplodoc/search-extension3.0.3. The patch sanitizes title content before it reaches the rendered search output. Refer to the GitHub Release v3.0.3 and the merged Pull Request #41 for the code change.

Workarounds

• Restrict write access to documentation repositories to trusted contributors and require code review for changes to Markdown front-matter.
• Deploy a strict CSP that disallows inline scripts (script-src 'self') on documentation hosts to limit XSS impact.
• Pre-process Markdown files in CI to strip HTML tags from title fields until the upgrade is deployed.

# Upgrade the vulnerable package to the patched version
npm install @diplodoc/search-extension@3.0.3 --save

# Verify the installed version
npm list @diplodoc/search-extension

# Rebuild documentation to regenerate the search index
npm run build