CVE-2026-53758
Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including <script> tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization, resulting in stored XSS visible to all site visitors. At time of publication, there are no publicly known patches.
| CWE | CWE-79 |
| Vendor | emlog |
| Product | emlog |
| Published | Sep 4, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for emlog emlog
Be the first to know when new unknown vulnerabilities affecting emlog emlog are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
emlog / emlog
<= 2.6.29