CVE-2021-47842
Published: 16 January 2026
Summary
CVE-2021-47842 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Imgur (inferred from references). Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2021-47842 is a persistent cross-site scripting vulnerability (CWE-79) affecting StudyMD version 0.3.2. The flaw enables attackers to inject malicious scripts into markdown files, which are then persistently stored and rendered by the application.
Any unauthenticated attacker (PR:N) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N), as indicated by its CVSS v3.1 base score of 7.2 (S:C/C:L/I:L/A:N). By uploading crafted markdown files with embedded JavaScript payloads, attackers can achieve script execution in the victim's browser when the file is opened, potentially leading to remote code execution.
Advisories from VulnCheck detail the issue at https://www.vulncheck.com/advisories/studymd-persistent-cross-site-scripting, and a proof-of-concept exploit is available on Exploit-DB at https://www.exploit-db.com/exploits/49832. The StudyMD GitHub repository is located at https://github.com/jotron/StudyMD.
A screenshot related to the vulnerability is hosted at https://imgur.com/a/lDHKEIp, and the CVE was published on 2026-01-16.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2879
Vulnerability details
StudyMD 0.3.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can upload crafted markdown files with embedded JavaScript payloads that execute when the file is opened, potentially enabling remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing web app directly enables exploitation via malicious file upload and JavaScript execution in browser.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of all untrusted markdown input to block embedded JavaScript payloads before persistent storage.
Requires output filtering of rendered markdown content so that malicious scripts are stripped before they reach the victim's browser.
Enables malicious-code scanning of uploaded files to identify and block JavaScript payloads associated with this stored-XSS attack.