{"id":"CVE-2026-43887","summary":"Outline: Stored XSS via Comment Mentions","details":"Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions. As a result, potentially dangerous protocols (e.g., javascript:) are not filtered, introducing a risk of client-side code execution. This vulnerability is fixed in 1.7.0.","aliases":["GHSA-rqrg-f3qc-xvgh"],"modified":"2026-07-15T01:49:16.542755344Z","published":"2026-05-11T21:05:42.302Z","database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43887.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43887.json"},{"type":"ADVISORY","url":"https://github.com/outline/outline/security/advisories/GHSA-rqrg-f3qc-xvgh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43887"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/outline/outline","events":[{"introduced":"8ab0c6ff484f02b5d97e130b20376a17dd4546cc"},{"fixed":"568b4ac074c67c5c58c75637c3a60b41f5bb1e6b"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.84.0"},{"fixed":"1.7.0"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43887.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"}]}