CVE-2026-24127

{"id": "CVE-2026-24127", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24127", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T16:14:37.675485Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "typemill", "product": "typemill", "versions": [{"status": "affected", "version": "< v2.19.2"}]}]}], "published": "2026-01-23T23:15:54.360", "references": [{"url": "https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/typemill/typemill/releases/tag/v2.19.2", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2."}, {"lang": "es", "value": "Typemill es un CMS de archivo plano, basado en Markdown, dise\u00f1ado para sitios web de documentaci\u00f3n informativa. Un Cross-Site Scripting (XSS) reflejado existe en la plantilla de vista de error de inicio de sesi\u00f3n 'login.twig' de las versiones 2.19.1 e inferiores. El valor 'username' puede ser devuelto sin la codificaci\u00f3n contextual adecuada cuando la autenticaci\u00f3n falla. Un atacante puede ejecutar scripts en el contexto de la p\u00e1gina de inicio de sesi\u00f3n. Este problema ha sido solucionado en la versi\u00f3n 2.19.2."}], "lastModified": "2026-06-17T10:22:40.423", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:typemill:typemill:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E3CADA3-5037-4F37-9488-CE162A458090", "versionEndExcluding": "2.19.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}