CVE-2026-48788: Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Synopsis

A stored cross-site scripting (XSS) vulnerability exists in Remark42, a self-hosted comment engine, affecting versions 1.6.0 through 1.15.0. The flaw is in the image proxy endpoint (/api/v1/img), which accepts a remote URL if it advertises an image Content-Type header, then re-serves the response using byte-sniffed Content-Type detection; an attacker can exploit this mismatch to have the browser render attacker-controlled HTML and JavaScript within Remark42's own origin. No account on the target instance is required, and a successful attack allows the attacker to run arbitrary scripts in the victim's browser session, enabling session hijacking and limited content tampering. A patched-image rebuild at version 1.16.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Remark42 image proxy endpoint over the network, and the victim must load the crafted proxy URL from a browser.

• AuthenticationNot required

  No Remark42 account or credentials are needed; the image proxy endpoint is accessible without authentication.

• Victim interactionRequired

  The victim must click or otherwise load the attacker-supplied proxy link, typically delivered via email, direct message, or an external website.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker only needs to control a remote URL that returns an HTML/JavaScript body while advertising an image Content-Type header, a straightforward setup with no race conditions or environment-specific dependencies.

Blast Radius

• Attacker-controlled JavaScript executes within Remark42's origin, giving access to the victim's session cookies and authentication tokens for that origin.
• The attacker can read any data accessible to the victim's session, including comment content and any user profile information exposed client-side.
• The attacker can make authenticated requests to the Remark42 API on behalf of the victim, including posting or modifying comments.