Vulnerability GO-2026-5804
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 months ago
July 07, 2026 at 03:26 PM UTC
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing in github.com/umputun/remark42
>=1.6.0 <1.16.0
>=1.6.0 <1.16.0
Summary
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing in github.com/umputun/remark42
Details
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing in github.com/umputun/remark42
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
7 hours ago
Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment
>=1.0.0 <=1.2.0 GHSA-56x6-q882-mf27
>=1.0.0 <=1.2.0 GHSA-56x6-q882-mf27
High Risk
4 months ago
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
>=1.6.0 <1.16.0 GHSA-4c8j-mgm4-qqvp
>=1.6.0 <1.16.0 GHSA-4c8j-mgm4-qqvp
Impacted packages
Timeline
Published
4 months ago
July 07, 2026 at 03:26 PM UTC
Fixed (v1.16.0)
5 months ago
May 22, 2026 at 06:24 PM UTC
Last Modified
4 months ago
July 07, 2026 at 04:01 PM UTC