CVE-2026-24127

6.1 mediumEPSS 0.3%

Medium (6.1) in typemill typemill. EPSS 0.3% chance of exploitation in the next 30 days.

Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-116
Published: 2026-01-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

typemill:typemill

References

https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c
https://github.com/typemill/typemill/releases/tag/v2.19.2
https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr

Check your stack JSON