CVE-2024-40626: high-severity vulnerability in outline
Stored Cross-site Scripting (XSS) vulnerability in Outline editor
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 0.5%
Outline is an open source, collaborative document editor. A type confusion issue was found in ProseMirror’s rendering process that leads to a Stored Cross-Site Scripting (XSS) vulnerability in Outline. An authenticated user can create a document containing a malicious JavaScript payload. When other users view this document, the malicious Javascript can execute in the origin of Outline. Outline includes CSP rules to prevent third-party code execution, however in the case of self-hosting and having your file storage on the same domain as Outline a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions. This issue has been addressed in release version 0.77.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected products
outline · outlineRelated CVEs — outline
In the same product, most dangerous first.
CVE-2026-113611MEDIUMOutline before 1.8.0 Information Disclosure via Orphaned Webhook SubscriptionsEPSS 0.5%CVE-2026-54573MEDIUMAuthorization Bypass in API Key/OAuth Scopes via Path Parsing DiscrepancyEPSS 0.5%CVE-2026-33640CRITICALOutline has a rate limit bypass that allows brute force of email login OTPEPSS 0.5%CVE-2026-25062MEDIUMOutline Affected an Arbitrary File Read via Path Traversal in JSON ImportEPSS 0.4%CVE-2025-58351MEDIUMOutline's Local File Storage Feature can Cause CSP BypassEPSS 0.4%CVE-2026-43888HIGHOutline: Zip Extraction Path Escape via PATH_MAX Truncation in Collection ImportEPSS 0.4%