CVE-2026-24127: typemill Cross-site Scripting

Vulnerability summary

CVE-2026-24127 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in typemill. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-01-2026
   PublishedVulnerability first disclosed.
2. 26-01-2026
   Last modifiedVulnerability information updated.

Description

Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
• CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.