{"id":"GHSA-rjmp-rwj4-mv82","revision":"6845afc95237466b950f3c7d165e2621","records":[{"revision":"6845afc95237466b950f3c7d165e2621","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-rjmp-rwj4-mv82","aliases":["CVE-2026-40201"],"title":"@diplodoc/search-extension allows stored XSS via Markdown file title","description":"@diplodoc/search-extension 1.0.0 through 3.0.2 allows stored XSS via .md file title.","state":0,"publishedAt":"2026-05-01T09:30:25+00:00","modifiedAt":"2026-05-07T03:26:26.378136+00:00","affected":[{"ecosystem":"npm","name":"@diplodoc/search-extension","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"3.0.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-40201","https://github.com/diplodoc-platform/search-extension/pull/41","https://github.com/diplodoc-platform/search-extension","https://github.com/diplodoc-platform/search-extension/releases","https://github.com/diplodoc-platform/search-extension/releases/tag/v3.0.3","https://github.com/eyelessgoddd/eyelessgoddd/blob/main/README.md"],"sourceUrl":"https://github.com/advisories/GHSA-rjmp-rwj4-mv82","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rjmp-rwj4-mv82","identifiers":["GHSA-rjmp-rwj4-mv82","CVE-2026-40201"]},"retained":false,"historicalAffected":[]}],"coverage":[]}