Unrated severityOSV Advisory· Published Jan 23, 2026· Updated Jan 26, 2026
Typemill has Reflected XSS via login error view template
CVE-2026-24127
Description
Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template login.twig of versions 2.19.1 and below. The username value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88cmitrex_refsource_MISC
- github.com/typemill/typemill/releases/tag/v2.19.2mitrex_refsource_MISC
- github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wrmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.