← Database

CVE-2025-46654

MEDIUM CVSS: 4.9 Published: 2025-04-26 Modified: 2026-06-17

Description

CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file.

Affected Platforms

Hackmd Codimd

Weakness Type

CWE-424

References