CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2026-21483

Trust Issues: Escalating from Newsletter Editor to God Mode in Listmonk

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·6 min read·23 visits

Executive Summary (TL;DR)

Listmonk versions prior to 6.0.0 trusted user input a little too much. By abusing the 'Safe' template filter, an attacker with basic campaign editing rights can inject malicious JavaScript. When an administrator previews this campaign, the script executes, effectively handing over the keys to the kingdom.

A critical Stored XSS vulnerability in the popular self-hosted newsletter manager, listmonk, allows low-privileged users to hijack administrative accounts via unsafe template rendering.

Official Patches

ListmonkRelease v6.0.0 containing security fixes

Fix Analysis (1)

Technical Appendix

CVSS Score
8.0/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected Systems

listmonk < 6.0.0

Affected Versions Detail

Product
Affected Versions
Fixed Version
listmonk
listmonk
< 6.0.06.0.0
AttributeDetail
CWE IDCWE-79
Attack VectorNetwork (Stored XSS)
CVSS v3.18.0 (High)
Privileges RequiredLow (campaigns:manage)
User InteractionRequired (Admin views preview)
ImpactAccount Takeover / Privilege Escalation

MITRE ATT&CK Mapping

T1189Drive-by Compromise
Initial Access
T1059.007Command and Scripting Interpreter: JavaScript
Execution
T1098Account Manipulation
Persistence
CWE-79
Stored Cross-Site Scripting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Known Exploits & Detection

Manual AnalysisStored XSS via campaign body using 'Safe' template filter.

Vulnerability Timeline

Patch Committed
2025-12-31
Public Disclosure & Release
2026-01-02

References & Sources

  • [1]GHSA-jmr4-p576-v565
  • [2]NVD - CVE-2026-21483

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•43 minutes ago•CVE-2026-55099
7.5

CVE-2026-55099: Algorithmic Complexity Denial of Service in icalendar Component Equality

An algorithmic complexity denial of service vulnerability exists in the Python icalendar library's component equality evaluation. Due to recursive nested comparisons inside list membership operations, parsing and validating calendar components with deep nesting triggers exponential execution time, blocking application threads and consuming 100% of the available CPU core.

Alon Barad
Alon Barad
4 views•8 min read
•about 2 hours ago•CVE-2026-54338
5.3

CVE-2026-54338: JupyterHub Unauthenticated Denial of Service via Unbounded Username Logging

JupyterHub is vulnerable to an unauthenticated Denial of Service (DoS) vulnerability. Prior to version 5.5.0, form-based authenticators failed to restrict the size of the username input field on failed logins, allowing remote attackers to exhaust host storage and memory resources.

Amit Schendel
Amit Schendel
1 views•11 min read
•about 3 hours ago•CVE-2026-55605
5.3

CVE-2026-55605: Missing Authentication in @arikusi/deepseek-mcp-server HTTP Transport Endpoint

The self-hosted HTTP transport mode of @arikusi/deepseek-mcp-server (an MCP server for DeepSeek V4) exposes its JSON-RPC endpoint (POST /mcp) without authentication in versions 1.4.2 through 1.7.0. Unauthenticated clients can establish Model Context Protocol sessions and invoke tools, consuming the host's configured DeepSeek API key.

Alon Barad
Alon Barad
5 views•6 min read
•about 4 hours ago•GHSA-VWF3-4XXJ-QG6H
9.8

GHSA-VWF3-4XXJ-QG6H: Server-Side Template Injection in mcp-contextforge-gateway

A Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) was discovered in the mcp-contextforge-gateway package before version 1.0.0. The vulnerability stems from an unsandboxed Jinja2 template rendering environment combined with an unsafe fallback mechanism using Python's native str.format() function. Attackers with template modification access could bypass static regex filters to execute arbitrary commands on the hosting platform.

Amit Schendel
Amit Schendel
2 views•7 min read
•about 5 hours ago•CVE-2026-55596
8.7

CVE-2026-55596: DOM-based Cross-Site Scripting (XSS) in Plate Media Embed Component

CVE-2026-55596 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Plate rich-text editor framework (specifically within the @platejs/media package). The issue stems from an optimization fast-path that short-circuits safety parsing if a provider or source URL is already declared on an element. Consequently, serialized documents carrying malicious javascript: URLs bypass protocol sanitization and are loaded directly into iframe elements, leading to code execution.

Amit Schendel
Amit Schendel
3 views•6 min read
•about 6 hours ago•GHSA-8QX3-8GM5-9CJ2
7.8

GHSA-8QX3-8GM5-9CJ2: Terminal Escape-Sequence Injection in pickem

The npm package 'pickem' is vulnerable to a terminal escape-sequence injection (CWE-150). Unsanitized terminal outputs allow attackers to execute arbitrary shell commands via clipboard hijacking (OSC 52) or manipulate terminal displays through Control Sequence Introducers (CSI).

Alon Barad
Alon Barad
5 views•6 min read