CVE-2026-28405

High

Published: 05 March 2026

Published

05 March 2026

Modified

10 March 2026

KEV Added

—

Patch

—

CVSS Score 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0004 11.4th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-28405 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Markusproject Markus. Its CVSS base score is 8.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to JavaScript (T1059.007) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-15 Information Output Filtering good match

prevent

Directly prevents XSS by requiring filtering or encoding of student-submitted file contents before rendering in the html_content route.

SI-2 Flaw Remediation good match

prevent

Ensures timely identification, reporting, and patching of the XSS flaw as fixed in MarkUs version 2.9.1.

SI-10 Information Input Validation partial match

prevent

Validates uploaded file contents to block malicious HTML/JavaScript payloads before storage and rendering.

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

Why these techniques?

Stored XSS enables direct injection/execution of attacker-controlled JavaScript in the victim's browser context (T1059.007) and directly facilitates session hijacking plus cookie theft (T1185, T1539) when the unsanitized submission is viewed.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content route reads the contents of a student-submitted file and renders them without sanitization. This issue has been patched in version 2.9.1.

Deeper analysisAI

CVE-2026-28405 is a cross-site scripting vulnerability (CWE-79) affecting MarkUs, an open-source web application used for the submission and grading of student assignments. In versions prior to 2.9.1, the route `/courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content` reads the contents of a student-submitted file and renders it without proper sanitization, enabling the injection and execution of malicious scripts. The vulnerability was published on 2026-03-05 and carries a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

An authenticated user with low privileges, such as a student, can exploit this vulnerability by uploading a file containing malicious HTML or JavaScript payload. Exploitation requires a victim—typically an instructor or another authorized user—to access the affected route for that submission, triggering the unsanitized rendering and script execution in the victim's browser context. Successful attacks can result in high-impact compromise of confidentiality, integrity, and availability, such as session hijacking, data theft, or further system manipulation.

The issue has been addressed in MarkUs version 2.9.1, where sanitization was added to prevent script injection. Administrators should upgrade to this patched release immediately. Additional details on the fix are provided in the GitHub security advisory (GHSA-p5pc-pxrj-3893), release notes for v2.9.1, and the specific patching commit (55d74f2ddb72d2ec2f29aa2b4cb6b2da10755036).