CVE-2026-129170
FileCodeBox 2.2.1 through 2.8.4 Stored XSS via Markdown Preview Parser Error
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage.
| CWE | CWE-79 |
| Vendor | vastsa |
| Product | filecodebox |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for vastsa filecodebox
Be the first to know when new medium vulnerabilities affecting vastsa filecodebox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
vastsa / FileCodeBox
2.2.1 ≤ 2.8.4
References
vul.yulun.ac.cn: https://vul.yulun.ac.cn/20261027/filecodebox/ github.com: https://github.com/vastsa/FileCodeBox/issues/557 github.com: https://github.com/vastsa/FileCodeBoxFronted/commit/4c40406d366af1583a3ba2327366b7a62d765537 github.com: https://github.com/vastsa/FileCodeBoxFronted/blob/bcc1dbda06b772d6f4afbcc12c6f12e60bbbc7da/src/utils/content-preview.ts#L43-L57 github.com: https://github.com/vastsa/FileCodeBoxFronted/blob/bcc1dbda06b772d6f4afbcc12c6f12e60bbbc7da/src/components/common/ContentPreviewModal.vue#L45-L50 vulncheck.com: https://www.vulncheck.com/advisories/filecodebox-2.2.1-through-2.8.4-stored-xss-via-markdown-preview-parser-error
Credits
Wu Yulun