Mbin: Stored cross-site scripting via Markdown image nested in link
Summary
Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in the Markdown embed handling. Authenticated users can embed HTML in the alt text of an image nested in a link within entries, comments, posts, messages or bios. The script runs in the browsers of users who view this content, which can enable session hijacking or content manipulation.
Affected
- Mbin 1.2.1 to before 1.11.1
- Unaffected: 1.11.1 and later
Fixed in
- Upgrade to Mbin 1.11.1 or later
Workaround
- Unknown. No vendor workaround is documented in the sources reviewed.
Exploitation
- No known exploitation found at the time of research.
- No public proof-of-concept found.
- Not listed in the CISA KEV catalog according to one secondary source.
Our recommendation
- If you operate a Mbin instance, upgrade to version 1.11.1 or later.
- Until patched, restrict who can register or post on the instance.
- Review recent content with images embedded in links for suspicious HTML.
- If you do not run Mbin, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record (CNA VulnCheck) www.cve.org
- Mbin v1.11.1 release github.com
- Fix commit 736fd39 github.com
- Vendor advisory GHSA-g3r9-j6w4-2257 github.com
- VulnCheck advisory www.vulncheck.com
- EmbedElement.php at v1.11.0 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:03.
Original description (NVD)
Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers.
NVD references (5)
- https://github.com/MbinOrg/mbin/blob/v1.11.0/src/Markdown/CommonMark/EmbedElement.php#L57-L67
- https://github.com/MbinOrg/mbin/commit/736fd39fe9cd59f5d51636d25e1857d88ddbd0bd
- https://github.com/MbinOrg/mbin/releases/tag/v1.11.1
- https://github.com/MbinOrg/mbin/security/advisories/GHSA-g3r9-j6w4-2257
- https://www.vulncheck.com/advisories/mbin-1.2.1-before-1.11.1-stored-xss-via-markdown-image-nested-in-link
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.