PT-2026-23628 · Markus · Markus

Ibrah-M + 1 · Published 2026-03-06 · Updated 2026-03-12 · CVE-2026-27807

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.9.4

Description MarkUs is a web application used for submitting and grading student assignments. Versions of MarkUs before 2.9.4 allow course instructors to upload YAML files to create or update entities like assignment settings. The application parses these YAML files with aliases enabled, which can lead to issues. This issue was addressed in version 2.9.4. YAML aliases allow defining reusable parts within a YAML file, potentially leading to unintended consequences if not handled securely during parsing.

Recommendations Update to version 2.9.4 or later.

Exploit

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2026-27807

GHSA-M9RX-85MX-Q9H6

Affected Products

Markus

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27807.json · Exploit
• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-m9rx-85mx-q9h6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27807 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27807 · Vendor Advisory
• https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4 · Note
• https://t.me/cveNotify/155318 · Telegram Post