CVE-2021-47838
Published: 16 January 2026
Summary
CVE-2021-47838 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Imgur (inferred from references). Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
Markright 1.0, a markdown processing library, contains a persistent cross-site scripting vulnerability identified as CVE-2021-47838 (CWE-79). This flaw enables attackers to embed malicious payloads within markdown files, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The issue was published on 2026-01-16.
Attackers can exploit this vulnerability by uploading specially crafted markdown files to systems or services using Markright 1.0. When victims open these files, the embedded payloads execute arbitrary JavaScript in the context of the application, potentially leading to remote code execution on the victim's system. The CVSS vector indicates exploitation is possible over the network with low complexity, no privileges or user interaction required, and changed scope for cross-context impact.
Advisories and additional details, including potential mitigations and patches, are available from sources such as the Markright GitHub repository (https://github.com/dvcrn/markright) and Vulncheck advisories (https://www.vulncheck.com/advisories/markright-persistent-cross-site-scripting). A proof-of-concept exploit is publicly documented on Exploit-DB (https://www.exploit-db.com/exploits/49834).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2901
Vulnerability details
Markright 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to embed malicious payloads in markdown files. Attackers can upload specially crafted markdown files that execute arbitrary JavaScript when opened, potentially enabling remote code execution on the victim's system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Persistent XSS in markdown parser directly enables arbitrary JavaScript execution (T1059.007) via user-opened malicious files (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of all markdown input to reject or neutralize embedded script payloads before they are stored or rendered.
Filters or sanitizes rendered markdown output so that malicious JavaScript is stripped before it reaches the victim's browser context.
Deploys malicious-code detection mechanisms that can recognize and block execution of unauthorized scripts introduced via uploaded markdown files.