Vulnerability Database

308,819

Total vulnerabilities in the database

CVE-2024-40626

Outline is an open source, collaborative document editor. A type confusion issue was found in ProseMirror’s rendering process that leads to a Stored Cross-Site Scripting (XSS) vulnerability in Outline. An authenticated user can create a document containing a malicious JavaScript payload. When other users view this document, the malicious Javascript can execute in the origin of Outline. Outline includes CSP rules to prevent third-party code execution, however in the case of self-hosting and having your file storage on the same domain as Outline a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions. This issue has been addressed in release version 0.77.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

  • Published: Jul 16, 2024
  • Updated: Nov 16, 2025
  • CVE: CVE-2024-40626
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.3
  • AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
getoutline / outline - 0.77.3