CVE-2026-53529 Overview
CVE-2026-53529 is a stored cross-site scripting (XSS) vulnerability in LeafWiki, a self-hosted wiki application. Page titles returned by the search API are rendered as raw HTML in the frontend prior to version 0.10.2. An authenticated user with editor or administrator permissions can create or modify a page title containing an HTML or JavaScript payload. When another user searches for a matching term, the payload executes in the victim's browser. Version 0.10.2 fixes the issue by ensuring author-controlled page titles in search results are not interpreted as raw HTML.
Critical Impact
Attackers with editor privileges can execute arbitrary JavaScript in victims' browsers through crafted page titles surfaced by the LeafWiki search API.
Affected Products
- LeafWiki versions prior to 0.10.2
- Deployments with --public-access enabled (unauthenticated visitors affected)
- Authenticated-only LeafWiki deployments (cross-user XSS against logged-in users)
Discovery Timeline
- 2026-08-21 - CVE-2026-53529 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-53529
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw classified under [CWE-79], improper neutralization of input during web page generation. LeafWiki accepts arbitrary strings as page titles from users with editor or administrator roles. When the search API returns matching pages, the frontend renders these titles as raw HTML rather than escaping them.
Any script embedded in a page title executes in the browsing context of the searching user. The blast radius depends on deployment. When --public-access is enabled, unauthenticated visitors performing searches are exposed. In authenticated-only deployments, the flaw enables cross-user XSS against any logged-in user with search access, including administrators.
Root Cause
The frontend interprets author-controlled page titles as HTML markup instead of escaping them before insertion into the DOM. The unsafe rendering path was tied to preserving search result highlighting, which required inline markup. The fix in version 0.10.2 keeps highlighting functional while preventing raw HTML interpretation of the underlying title content.
Attack Vector
An attacker with editor or administrator permissions creates or edits a wiki page whose title contains a JavaScript payload. The attacker then either waits for a victim to perform a matching search or induces the search by sharing a link or term. When the search API returns the malicious title, the frontend injects it into the results view and the payload executes with the victim's session context.
The vulnerability manifests in the search results rendering path. Refer to the GitHub Security Advisory GHSA-j344-qxqm-wg64 for technical details on the affected code.
Detection Methods for CVE-2026-53529
Indicators of Compromise
- Wiki page titles containing HTML tags such as <script>, <img>, <svg>, or event handler attributes like onerror= and onload=.
- Unusual outbound network requests originating from browser sessions immediately after users interact with the LeafWiki search interface.
- Audit log entries showing page creation or title edits by editor or administrator accounts with unexpected non-text characters.
Detection Strategies
- Query the LeafWiki page store for titles containing angle brackets, backticks, or JavaScript scheme fragments.
- Inspect HTTP responses from the /api/search endpoint for HTML tags embedded within title fields.
- Review web server access logs for search queries followed by anomalous asset loads or beacon requests from client browsers.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script violations originating from the LeafWiki frontend.
- Monitor authenticated editor and administrator account activity for unexpected page title modifications.
- Alert on browser telemetry indicating script execution from wiki search result views.
How to Mitigate CVE-2026-53529
Immediate Actions Required
- Upgrade LeafWiki to version 0.10.2 or later on all deployments.
- Audit existing page titles for HTML or JavaScript payloads and sanitize or delete affected records.
- Review editor and administrator account membership and revoke unnecessary privileges.
Patch Information
The issue is fixed in LeafWiki version 0.10.2. The patch ensures author-controlled page titles returned by the search API are not interpreted as raw HTML by the browser, while preserving search result highlighting. See the GitHub Security Advisory GHSA-j344-qxqm-wg64 for release details.
Workarounds
- Disable --public-access to limit exposure to authenticated users only until the upgrade is applied.
- Restrict editor and administrator roles to trusted accounts and enforce strong authentication.
- Deploy a strict Content Security Policy that blocks inline scripts on the LeafWiki frontend.
- Manually remove or rename any page titles containing HTML markup before users perform searches.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
