Stored XSS in Search Result Titles

Summary

A stored cross-site scripting vulnerability existed in the search results UI.

Page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the payload could execute in the victim’s browser.

The impact depends on deployment configuration. With --public-access enabled, unauthenticated visitors could be affected. In authenticated-only deployments, the issue could be used for cross-user XSS against logged-in users who can access search results.

Affected versions

<= 0.10.1

Patched versions

0.10.2

Impact

A malicious editor could create a page title containing attacker-controlled HTML and a searchable term. When another user searched for that term, JavaScript could execute in that user’s browser context.

This could allow actions to be performed as the affected user within the application, depending on that user’s permissions and browser/session state.

Workarounds

Upgrade to 0.10.2 or later.

Before upgrading, restrict page creation and editing permissions to trusted users.

Deployments using --public-access should consider disabling public access if untrusted users have editor permissions.

Remediation

Upgrade to 0.10.2 or later.

The issue has been fixed by ensuring that author-controlled page titles in search results are not interpreted as raw HTML by the browser while preserving search result highlighting.

Credits

Reported by @tonghuaroot & @shafiqaimanx.