Unrated severityOSV Advisory· Published Jan 23, 2026· Updated Jan 26, 2026
Typemill has Reflected XSS via login error view template
CVE-2026-24127
Description
Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template login.twig of versions 2.19.1 and below. The username value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88cmitrex_refsource_MISC
- github.com/typemill/typemill/releases/tag/v2.19.2mitrex_refsource_MISC
- github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wrmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.