High severity8.1NVD Advisory· Published Aug 30, 2021· Updated Jun 17, 2026
CVE-2021-39175
CVE-2021-39175
Description
HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into another page. The problem is patched in version 1.9.0. There are no known workarounds aside from upgrading.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/hedgedoc/hedgedoc/pull/1369nvdPatchThird Party Advisory
- github.com/hedgedoc/hedgedoc/pull/1375nvdPatchThird Party Advisory
- github.com/hedgedoc/hedgedoc/pull/1513nvdPatchThird Party Advisory
- github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697nvdPatchThird Party Advisory
News mentions
0No linked articles in our index yet.