PT-2026-23504 · Markus · Markus

Ibrah-M + 2 · Published 2026-03-05 · Updated 2026-03-07 · CVE-2026-28405

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.9.1

Description MarkUs is a web application used for submitting and grading student assignments. Versions prior to 2.9.1 are susceptible to an issue where the application reads and renders the contents of student-submitted files without proper sanitization via the courses/<:course id>/assignments/<:assignment id>/submissions/html content route. The vulnerable route allows for the execution of arbitrary HTML content. The course id and assignment id are parameters used in the affected API endpoint.

Recommendations Update to version 2.9.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28405

GHSA-P5PC-PXRJ-3893

Affected Products

Markus

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28405.json · Exploit
• https://github.com/MarkUsProject/Markus/commit/55d74f2ddb72d2ec2f29aa2b4cb6b2da10755036 · Patch
• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-p5pc-pxrj-3893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28405 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28405 · Vendor Advisory
• https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1 · Note
• https://twitter.com/TheHackerWire/status/2030297409583304752 · Twitter Post
• https://twitter.com/CVEnew/status/2030385215621808595 · Twitter Post