CVE-2026-129170 in FileCodeBox
Summary
by MITRE • 11/13/2026
FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
FileCodeBox versions 2.2.1 through 2.8.4 are susceptible to a stored cross-site scripting vulnerability located within the renderMarkdownPreview function. This flaw arises because the application fails to properly sanitize user-supplied input when processing markdown content, specifically in scenarios where the underlying marked parser encounters an error or throws an exception during parsing operations. Instead of handling these errors gracefully by escaping potentially malicious characters, the system returns unsanitized text directly to the client-side interface. This lack of output encoding allows attackers to inject executable JavaScript code into pages that are rendered for other users, particularly administrators who view shared files containing the injected payload.
The exploitation mechanism relies on crafting a specific markdown structure designed to trigger the parser's error handling path while embedding malicious script tags within the resulting HTML output. Attackers can achieve this by sharing text documents that contain thousands of nested blockquote markers followed immediately by HTML payloads. The depth and complexity of these nested structures are intended to overwhelm or confuse the parsing logic, causing it to fail in a way that bypasses standard sanitization routines. When an administrator opens such a file within the application's preview interface, the browser executes the embedded JavaScript code due to the unsanitized nature of the returned content.
The operational impact of this vulnerability is severe, as it enables unauthenticated attackers to execute arbitrary scripts in the context of the victim user’s session. In this specific instance, the primary objective is credential theft via access to local storage data. The injected script targets the localStorage object, which often contains sensitive authentication tokens or session identifiers used by FileCodeBox for maintaining administrative privileges and user sessions. By stealing these tokens, an attacker can impersonate the administrator without needing valid login credentials, thereby gaining full control over the application instance. This level of access allows for further exploitation such as data exfiltration, modification of system configurations, installation of backdoors, or complete compromise of the underlying server infrastructure hosting FileCodeBox.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as cross-site scripting. The stored nature of the attack means that the malicious payload is persisted on the target system and executed whenever another user accesses the affected resource, distinguishing it from reflected XSS attacks where payloads are delivered via URL parameters or form submissions in real-time. Additionally, this exploitation technique maps to MITRE ATT&CK techniques related to Client-side Scripting Injection and potentially Credential Access through Browser Session Hijacking if the stolen tokens provide persistent access.
Mitigation strategies should focus on both immediate remediation and long-term security hardening. The most effective solution is to upgrade FileCodeBox to a version newer than 2.8.4 where this parsing flaw has been addressed by developers with proper input validation and output encoding mechanisms implemented in the renderMarkdownPreview function. For organizations unable to patch immediately, implementing a Web Application Firewall can help detect and block requests containing deeply nested markdown structures or known XSS payloads before they reach the application logic. Furthermore, enforcing strict Content Security Policy headers that restrict script execution from untrusted sources can mitigate the impact of any successful injection attempts by preventing inline scripts from executing unless explicitly whitelisted. Regular security audits focusing on parser behavior under edge cases and error conditions are also recommended to prevent similar vulnerabilities in future updates.