CVE-2026-53758

Emlog, an open source website-building system, processes article content with the Parsedown library while its safe mode is disabled, so raw HTML embedded in Markdown -- including <script> tags -- passes through unescaped and is rendered without any additional sanitization. An attacker who can supply article content can therefore embed JavaScript that executes in the browser of every visitor who views the article; the CVSS 4.0 vector rates the attack as network-based, unauthenticated, and requiring no special conditions. Successful exploitation gives the attacker script execution in all visitors' browsers under the affected site's origin, enabling actions such as cookie/session theft or unauthorized in-page actions on behalf of visitors. Any Emlog deployment running version 2.6.29 or earlier is affected. As of publication there is no available patch, no public proof-of-concept, and no publicly known exploitation (EPSS about 0.3%, not listed in CISA KEV).

What to do: No fixed release exists yet, so monitor the Emlog project for a version later than 2.6.29 and upgrade as soon as one is published. As interim mitigation, restrict article authoring to trusted users and add output-side sanitization that strips <script> tags and event-handler attributes from rendered article HTML. Verify your installed Emlog version and review existing article content for unexpected HTML or injected scripts, since stored payloads would run for all visitors.