Is CVE-2026-107798 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-107798?

CVE-2026-107798 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-107798

Description

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to execute JavaScript when other users click or hover over rendered links.