PT-2026-39855 · Outline · Outline

Leonardo-Doyensec · Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-43887

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Outline versions 0.84.0 through 1.6.1

Description The comment section allows users to mention other users, but the backend fails to validate or sanitize the href attribute associated with these mentions. This allows the use of dangerous protocols, such as javascript:, which can lead to client-side code execution via Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites.

Recommendations Update to version 1.7.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-43887

Affected Products

Outline

References · 4

• 🔥 https://github.com/outline/outline/security/advisories/GHSA-rqrg-f3qc-xvgh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43887 · Security Note
• https://t.me/CVEtracker/53418 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054002669279170896 · Twitter Post