PT-2026-4535 · Typemill · Typemill

Adrien Brunner · Published 2026-01-23 · Updated 2026-02-02 · CVE-2026-24127

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Typemill versions 2.19.1 and below

Description Typemill is a flat-file, Markdown-based CMS for informational documentation websites. A reflected Cross-Site Scripting (XSS) issue exists in the login error view template login.twig. The username value is echoed back without proper encoding when authentication fails, allowing an attacker to execute script in the login page context.

Recommendations Update to version 2.19.2 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2026-24127

GHSA-65X4-PJHJ-R8WR

Affected Products

Typemill

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24127.json · Exploit
• 🔥 https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr · Exploit
• https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c · Patch
• https://osv.dev/vulnerability/CVE-2026-24127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24127 · Security Note
• https://github.com/typemill/typemill/releases/tag/v2.19.2 · Note
• https://twitter.com/VulmonFeeds/status/2014927096724775214 · Twitter Post
• https://t.me/cveNotify/150559 · Telegram Post
• https://twitter.com/CVEnew/status/2014995823608946968 · Twitter Post