CVE-2026-126945

Zipline stored XSS in HighlightCode component

critical · 9.3

Fix listed

Zipline

Published Nov 13, 2026, 09:34 UTC

Description

Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.

Reported fixed versions

4.5.1

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.