Vulnerabilidades do Hedgedoc Hedgedoc

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Hedgedoc Hedgedoc: 2 registro(s), com versões afetadas e correções.
cpe:2.3:a:hedgedoc:hedgedoc

CVE-2026-25642 Média · 6.1 CWE-79 06/02/2026

HedgeDoc security headers for uploaded files were not working

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more strict security-policy. This resulted in a too open Content-Security-Policy and furthermore opened the possibility to host malicious interactive web content (such as fake login forms) using SVG files. This vulnerability is fixed in 1.10.6.

CVE-2025-66629 Média · 4.3 CWE-352 05/12/2025

HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.