Markright 1.0 - Persistent Cross-Site Scripting | Advisories

Advisories

Markright 1.0 - Persistent Cross-Site Scripting

severity: medium
date: January 16, 2026
Affecting: Markright 1.0
CVE: CVE-2021-47838
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: ExploitDB-49834
Markright GitHub Repository
Proof of Concept Video
Credit: TaurusOmar
Description: Markright 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to embed malicious payloads in markdown files. Attackers can upload specially crafted markdown files that execute arbitrary JavaScript when opened, potentially enabling remote code execution on the victim's system.