CVE-2026-48788: Remark42 Comment Engine XSS Vulnerability

CVE-2026-48788 Overview

CVE-2026-48788 is a stored Cross-Site Scripting (XSS) vulnerability in Remark42, a self-hosted comment engine used by blogs and websites. Versions 1.6.0 through 1.15.0 are affected. The flaw resides in the image proxy, which inspects only the Content-Type header during download but sniffs the response bytes when serving. Attackers exploit this inconsistency to deliver HTML and JavaScript through what the proxy believes is an image. The malicious payload executes within the Remark42 origin in the victim's browser. The issue is tracked as [CWE-79] and was fixed in version 1.16.0.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in the Remark42 origin by tricking a victim into opening a crafted proxy link, enabling session theft and account takeover.

Affected Products

Remark42 version 1.6.0
Remark42 versions 1.7.0 through 1.14.0
Remark42 version 1.15.0

Discovery Timeline

2026-06-17 - CVE-2026-48788 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48788

Vulnerability Analysis

The Remark42 image proxy performs two independent content-type evaluations on the same upstream response. During the download phase, the proxy trusts the Content-Type header advertised by the remote server to confirm the resource is an image. During the serving phase, the proxy discards that header and invokes Go's http.DetectContentType, which inspects the actual byte stream to derive the response header it sends to the browser.

An attacker hosts an upstream URL that advertises Content-Type: image/png while returning an HTML or JavaScript body. The download check accepts the resource. The serving path then sniffs the body, identifies it as HTML, and emits Content-Type: text/html. The victim's browser renders the attacker-controlled markup as a document inside Remark42's own origin, granting the script full access to cookies, tokens, and the DOM of the comment widget.

Root Cause

The root cause is an inconsistent trust model between two pipeline stages. The download validator relied on attacker-supplied metadata, while the serving stage derived its own answer from the bytes. Because the two stages disagreed, content authorized as an image was delivered as executable HTML.

Attack Vector

Exploitation requires no Remark42 account on the target instance. The attacker hosts the malicious upstream URL, constructs a Remark42 proxy link pointing at it, and delivers the link to a victim by email, direct message, or a link on another website. The vulnerability requires user interaction but no privileges.

// Security patch in backend/app/rest/api/rest.go
// securityHeadersMiddleware sets security-related headers:
// - Content-Security-Policy: controls which resources the browser is allowed to load
// - Permissions-Policy: disables browser features (camera, mic, etc.) not needed by a comment widget
// - X-Content-Type-Options: prevents browsers from MIME-sniffing responses away from the declared type,
//   stopping e.g. a user-uploaded image from being reinterpreted as executable HTML/JS
// - Referrer-Policy: controls how much URL information leaks in the Referer header on cross-origin
//   requests; "strict-origin-when-cross-origin" sends only the origin (no path) to other domains
//   and nothing at all on HTTPS\\u2192HTTP downgrades
func securityHeadersMiddleware(imageProxyEnabled bool, allowedAncestors []string) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

Source: GitHub Commit 78d6de6

Detection Methods for CVE-2026-48788

Indicators of Compromise

Proxy requests to /api/v1/picture/... that return responses with Content-Type: text/html instead of an image MIME type.
Outbound fetches from the Remark42 host to attacker-controlled domains hosting non-image payloads.
Browser console errors or unexpected script execution originating from the Remark42 origin on pages embedding the comment widget.

Detection Strategies

Inspect HTTP access logs for image-proxy endpoints serving responses with Content-Type: text/html, application/xhtml+xml, or application/javascript.
Compare upstream Content-Type headers with the MIME type emitted to the client to surface sniffing mismatches.
Hunt for proxy URLs delivered through external referrers, particularly those pointing at recently registered or low-reputation hosts.

Monitoring Recommendations

Enable web application firewall rules that block proxy responses where sniffed content type diverges from the declared upstream type.
Monitor egress traffic from the Remark42 process for connections to unexpected destinations.
Alert on anomalous spikes in image-proxy traffic, particularly bursts following inbound traffic from messaging or social platforms.

How to Mitigate CVE-2026-48788

Immediate Actions Required

Upgrade Remark42 to version 1.16.0 or later, which adds X-Content-Type-Options: nosniff and Referrer-Policy headers and aligns the proxy's content-type checks.
If immediate upgrade is not possible, disable the image proxy feature in the Remark42 configuration.
Rotate any administrator or moderator session tokens that may have been exposed through the affected origin.

Patch Information

The fix is included in Remark42 v1.16.0. The commit 78d6de6 introduces X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin, preventing browsers from reinterpreting proxied responses. Additional context is available in the GitHub Security Advisory GHSA-4c8j-mgm4-qqvp.

Workarounds

Disable the image proxy by setting IMAGE_PROXY_HTTP2HTTPS=false and removing the proxy route from the deployment until the patch is applied.
Front Remark42 with a reverse proxy that injects X-Content-Type-Options: nosniff on all responses.
Restrict outbound network access from the Remark42 container so it cannot reach arbitrary attacker-hosted URLs.

bash

# Reverse proxy hardening example (nginx)
location /api/v1/picture/ {
    proxy_pass http://remark42_backend;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Content-Security-Policy "default-src 'none'; img-src 'self'" always;
}