CVE-2026-107798

MEDIUM 5.4

Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to execute JavaScript when other users click or hover over rendered links.

CWE	CWE-79
Vendor	banq
Product	jivejdon
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for banq jivejdon

Be the first to know when new medium vulnerabilities affecting banq jivejdon are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

banq / jivejdon

595d8d227fcdedf6f3b73540dd9f5d12dab399fe ≤ ee67a65e65228644a71c8317d7e34deea50f95ef

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/banq/jivejdon/issues/28 github.com: https://github.com/banq/jivejdon github.com: https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/domain/model/message/output/html/TextStyle.java#L242-L243 vulncheck.com: https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-stored-xss-via-markdown-links-in-textstyle-rendering-filter

Credits

Ikram-4