CVE-2026-58487 Overview
CVE-2026-58487 is a stored HTML injection vulnerability in HedgeDoc, an open source real-time collaborative markdown notes application. The flaw affects all versions prior to 1.11.0 and stems from unsafe handling of the local-part of registered email addresses. HedgeDoc accepted RFC 5321 quoted-string local-parts during registration, then reused the value as a display name without proper HTML escaping. Attackers who register a specially crafted email can inject arbitrary HTML into publish views, slide views, and the collaborative editor. The issue is classified under CWE-79 (Cross-site Scripting).
Critical Impact
An authenticated attacker can inject arbitrary HTML into pages viewed by other HedgeDoc users, enabling content spoofing and embedding of attacker-controlled cross-origin iframes.
Affected Products
- HedgeDoc versions prior to 1.11.0
- HedgeDoc publish and slide views
- HedgeDoc collaborative editor
Discovery Timeline
- 2026-07-13 - CVE-2026-58487 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-58487
Vulnerability Analysis
The vulnerability resides in HedgeDoc's user registration and display name rendering logic. During account creation, the application accepts email addresses that conform to RFC 5321, including quoted-string local-parts. These local-parts can contain characters such as quotes, angle brackets, and whitespace that carry special meaning in HTML contexts.
HedgeDoc extracts the local-part and reuses it as the user's display name. That display name is then rendered into HTML in multiple views without escaping. An attacker can craft a local-part that breaks out of an HTML attribute context and injects arbitrary markup.
The deployed Content-Security-Policy blocks straightforward inline JavaScript execution. However, the injected HTML is still sufficient to alter page content, spoof interface elements, and embed attacker-controlled resources such as cross-origin iframes. This creates a viable phishing and clickjacking primitive against collaborators viewing affected documents.
Root Cause
The root cause is missing output encoding of user-controlled display name data. HedgeDoc treats the email local-part as trusted text when constructing HTML, violating the principle of contextual output escaping. The application also fails to reject or normalize quoted-string local-parts that contain HTML metacharacters at registration time.
Attack Vector
The attack requires low-privilege network access. An attacker registers a HedgeDoc account using a quoted-string email such as "><injected markup>"@example.com. The attacker then interacts with any shared note, publish view, or slide deck viewed by other users. When victims load the affected views, their browsers render the injected HTML in the document's origin.
Refer to the GitHub Security Advisory GHSA-6c2w-8w96-3pcv for the full technical description.
Detection Methods for CVE-2026-58487
Indicators of Compromise
- Registered user accounts whose email local-part contains quotes, angle brackets, or other HTML metacharacters
- Unexpected iframes, images, or markup appearing in HedgeDoc publish or slide views
- Outbound requests from users' browsers to attacker-controlled origins when loading HedgeDoc content
Detection Strategies
- Audit the HedgeDoc user database for email addresses containing quoted-string local-parts or characters such as <, >, ", or /
- Inspect rendered HTML of publish and slide views for unexpected tags originating from user display names
- Review web server access logs for registration requests with unusual email formats
Monitoring Recommendations
- Enable content integrity monitoring on HedgeDoc-hosted pages to detect unexpected DOM elements
- Log and alert on new account registrations with non-standard email local-part formats
- Monitor CSP violation reports for blocked script or frame-src events originating from HedgeDoc origins
How to Mitigate CVE-2026-58487
Immediate Actions Required
- Upgrade HedgeDoc to version 1.11.0 or later without delay
- Identify and disable any existing accounts registered with quoted-string or metacharacter-laden email local-parts
- Review published notes and slide decks for injected markup and revoke sharing links where tampering is suspected
Patch Information
HedgeDoc version 1.11.0 fixes the vulnerability by properly handling email local-parts and escaping display names before HTML rendering. The patch is documented in the HedgeDoc GitHub Security Advisory. Administrators should follow the official HedgeDoc upgrade documentation for their deployment method.
Workarounds
- Restrict new user registration to trusted email domains and validate local-parts against a strict character allowlist
- Tighten the Content-Security-Policy to disallow frame-src and img-src from arbitrary external origins
- Disable public registration until the upgrade to 1.11.0 is completed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
