CVE-2026-129170

EUVD-2026-125597
FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/vastsa/FileCodeBox/issues/557
https://github.com/vastsa/FileCodeBoxFronted/blob/bcc1dbda06b772d6f4afbcc12c6f12e60bbbc7da/src/components/common/ContentPreviewModal.vue#L45-L50
https://github.com/vastsa/FileCodeBoxFronted/blob/bcc1dbda06b772d6f4afbcc12c6f12e60bbbc7da/src/utils/content-preview.ts#L43-L57
https://github.com/vastsa/FileCodeBoxFronted/commit/4c40406d366af1583a3ba2327366b7a62d765537
https://vul.yulun.ac.cn/20261027/filecodebox/
https://www.vulncheck.com/advisories/filecodebox-2.2.1-through-2.8.4-stored-xss-via-markdown-preview-parser-error