CVE-2026-86644: ShowDoc Editor Component XSS Vulnerability

CVE-2026-86644 Overview

CVE-2026-86644 is a cross-site scripting (XSS) vulnerability [CWE-79] in Showdoc, an open-source API documentation and team collaboration tool maintained by star7th. The flaw affects versions up to and including 3.9.1, and resides in web_src/public/editor.md/editormd.js within the API Page Save Endpoint. An authenticated attacker can inject script payloads through the save workflow, which are then rendered when other users view the affected content. The exploit has been publicly disclosed. The vendor addressed the issue in version 3.9.2 with commit a8ea1520850b4242f395247f72e87e597506cef0.

Critical Impact
Authenticated remote attackers can persist malicious JavaScript in Showdoc pages, leading to session theft, account hijacking, or delivery of malicious payloads to any user who opens the affected document.

Affected Products

star7th Showdoc versions up to and including 3.9.1
Component: web_src/public/editor.md/editormd.js (API Page Save Endpoint)
Fixed in Showdoc v3.9.2

Discovery Timeline

2026-09-08 - CVE-2026-86644 published to NVD
2026-09-08 - Last updated in NVD database
Fixed - Showdoc release v3.9.2 addresses the vulnerability via commit a8ea1520850b4242f395247f72e87e597506cef0

Technical Details for CVE-2026-86644

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the Markdown editor bundled with Showdoc. The affected code path lives in web_src/public/editor.md/editormd.js, which handles rendering of editor content including Mermaid diagrams and inline SVG. Because the renderer did not enforce a strict security policy on user-supplied diagram or Markdown input, an attacker with permission to save a page could embed HTML or script constructs that survive persistence and execute when the page is later rendered in another user's browser session.

Exploitation requires authentication and user interaction, in that a victim must open or preview the affected page. Because the payload is stored server-side, a single injection can affect any user with access to the document.

Root Cause

According to the vendor, the underlying issue is unsafe rendering of Mermaid diagrams and SVG content within the editor. The remediation "sets Mermaid securityLevel to strict, disables htmlLabels, and sanitizes rendered SVG with DOMPurify." This confirms the root cause: Mermaid was operating in a permissive mode that permitted raw HTML in labels, and downstream SVG output was inserted into the DOM without sanitization. Together, these behaviors allowed attacker-controlled markup to reach the DOM and execute as script [CWE-79].

Attack Vector

An authenticated user submits crafted Markdown or Mermaid diagram content to the API Page Save Endpoint. The payload is stored as part of the page. When another authenticated user renders the page, the vulnerable client-side logic in editormd.js inserts the attacker-controlled content into the DOM, triggering script execution in the victim's browser context under the Showdoc origin. A public proof-of-concept is available on GitHub Gist.

text

// Patch reference from composer.json (v3.9.1 -> v3.9.2)
    "Api"
],
"homepage": "https://github.com/star7th/showdoc",
-    "version": "v3.9.1",
+    "version": "v3.9.2",
"license": "Apache-2.0",

Source: Showdoc Commit a8ea1520

Detection Methods for CVE-2026-86644

Indicators of Compromise

Showdoc pages containing Mermaid diagram blocks with embedded HTML tags such as <script>, <img onerror=...>, or <foreignObject> elements.
Saved page content containing inline SVG with <script> children or on* event handler attributes.
Outbound HTTP requests from user browsers to unfamiliar domains immediately after opening a Showdoc page.

Detection Strategies

Review Showdoc page records in the database for Markdown or diagram source containing raw HTML, javascript: URIs, or SVG event handlers.
Inspect web server access logs for POST requests to the API Page Save Endpoint that include suspicious payload signatures.
Correlate authenticated session activity with anomalous cross-user page views that trigger outbound browser requests.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions originating from Showdoc pages.
Monitor Showdoc audit logs for page edits by low-privilege or newly created accounts.
Alert on Showdoc instances still reporting a version string of v3.9.1 or earlier after the patch window.

How to Mitigate CVE-2026-86644

Immediate Actions Required

Upgrade Showdoc to version 3.9.2 or later by pulling the Showdoc v3.9.2 release.
Audit existing pages created or modified before the upgrade for stored payloads and remove or sanitize suspicious content.
Rotate session tokens and credentials for any users who may have viewed compromised pages.

Patch Information

The fix is delivered in Showdoc release v3.9.2 via commit a8ea1520850b4242f395247f72e87e597506cef0. Per the vendor, the patch sets Mermaid securityLevel to strict, disables htmlLabels, and sanitizes rendered SVG with DOMPurify. Additional advisory context is available at VulDB CVE-2026-86644.

Workarounds

Restrict page creation and edit permissions to trusted accounts until the upgrade to v3.9.2 is applied.
Deploy a strict Content Security Policy that blocks inline scripts and disallows untrusted script sources for the Showdoc origin.
Place Showdoc behind a web application firewall (WAF) with rules that inspect POST bodies to the page save endpoint for HTML and SVG tag patterns.

bash

# Upgrade Showdoc to the patched release
git fetch --tags
git checkout v3.9.2
composer install --no-dev

# Verify the running version
grep '"version"' composer.json
# Expected output: "version": "v3.9.2",