Vulnerability · Published Jan 23, 2026 · Assigned by GitHub_M

CVE-2026-24127Typemill has Reflected XSS via login error view template

Medium 5.4

In plain English

A medium-severity cross-site scripting in typemill from typemill. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 77.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.

Affected products (as reported)

Vendor	Product	Versions
typemill	typemill	< v2.19.2

Weakness: CWE-79, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr x_refsource_CONFIRM
https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c x_refsource_MISC
https://github.com/typemill/typemill/releases/tag/v2.19.2 x_refsource_MISC