CVE-2026-90835: itranswarp Markdown XSS Vulnerability

CVE-2026-90835 Overview

CVE-2026-90835 is a cross-site scripting (XSS) vulnerability [CWE-79] in the michaelliao/itranswarp content management platform through version 2.19. The flaw resides in the Markdown.toHtml function within Markdown.java, part of the Page Content Rendering component. Attackers can inject malicious script content that executes in the browsers of users viewing affected pages. The exploit has been publicly disclosed. The project maintainer was notified through an issue report but has not responded, and the affected product is no longer supported.

Critical Impact
Remote attackers with low privileges can inject persistent JavaScript into rendered Markdown content, enabling session theft, credential harvesting, and account takeover against other users of the platform.

Affected Products

michaelliao itranswarp versions up to and including 2.19
Component: Page Content Rendering (Markdown.java)
Function: Markdown.toHtml

Discovery Timeline

2026-09-14 - CVE-2026-90835 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90835

Vulnerability Analysis

The vulnerability stems from insufficient output encoding in the Markdown.toHtml method inside Markdown.java. The function converts user-supplied Markdown into HTML for page rendering without stripping or neutralizing embedded HTML and JavaScript payloads. When a page containing crafted Markdown is served, the browser executes the injected script in the context of the itranswarp origin.

Because itranswarp is a content publishing platform, injected payloads persist on stored pages and execute for every visitor. This produces a stored (persistent) XSS condition that scales with page views. The maintainer has not addressed the issue, and the product line is end-of-life, so no vendor fix is expected.

Root Cause

The root cause is missing HTML sanitization in the Markdown-to-HTML pipeline. Markdown rendering libraries commonly allow inline HTML unless configured otherwise. Markdown.toHtml passes user input through the converter without applying an allow-list sanitizer such as OWASP Java HTML Sanitizer to the resulting HTML, leaving <script>, event-handler attributes, and javascript: URIs intact.

Attack Vector

An authenticated attacker with content-creation privileges submits Markdown containing raw HTML or script constructs through a page-edit endpoint. The server stores the content and later invokes Markdown.toHtml when rendering the page. Any visitor loading the affected page executes the attacker's script, enabling cookie theft, forced actions using CSRF-protected endpoints, keylogging, and pivoting to administrative accounts.

The vulnerability manifests when Markdown input containing HTML tags or event handler attributes is passed through the rendering function without sanitization. See the GitHub Issue #74 Discussion and the VulDB CVE-2026-90835 advisory for further technical detail.

Detection Methods for CVE-2026-90835

Indicators of Compromise

Stored page content containing <script> tags, on*= event-handler attributes, or javascript: URIs in Markdown source records.
Outbound requests from user browsers to unfamiliar domains immediately after rendering itranswarp pages.
Unexpected session token exfiltration or administrative actions originating from user sessions viewing content pages.

Detection Strategies

Audit the database tables storing page content for HTML tags and script constructs embedded in Markdown source.
Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to page-edit endpoints for XSS payloads.
Monitor rendered HTML output for the presence of script tags that did not originate from trusted templates.

Monitoring Recommendations

Log all content submission events with user attribution and payload hashes for retrospective review.
Alert on Content Security Policy (CSP) violation reports from browsers loading itranswarp pages.
Correlate authentication anomalies with page-view telemetry to identify session-hijacking chains.

How to Mitigate CVE-2026-90835

Immediate Actions Required

Migrate off michaelliao/itranswarp since the project is unmaintained and no patch is planned.
Restrict content-creation privileges to trusted users only until migration is complete.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted external sources.

Patch Information

No vendor patch is available. The maintainer was informed through the GitHub Issue #74 Discussion but has not responded, and the affected releases are no longer supported. Organizations must apply compensating controls or migrate to a maintained platform.

Workarounds

Fork the project and integrate the OWASP Java HTML Sanitizer to post-process output from Markdown.toHtml before it reaches the response.
Configure the Markdown converter to disable raw HTML passthrough where supported by the underlying library.
Place the application behind a WAF configured with XSS signatures targeting Markdown input fields.
Enforce a Content-Security-Policy header such as default-src 'self'; script-src 'self'; object-src 'none' to blunt exploitation impact.

bash

# Example Content Security Policy header to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;