Medium severity · published Mar 5, 2026
CVE-2026-28405
MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content route reads the contents of a student-submitted file and renders them without sanitization. This issue has been patched in version 2.9.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Markus · MarkUsProject
< 2.9.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28405
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28405
Patch
https://github.com/MarkUsProject/Markus/commit/55d74f2ddb72d2ec2f29aa2b4cb6b2da10755036
Release Notes
https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1
Vendor Advisory
https://github.com/MarkUsProject/Markus/security/advisories/GHSA-p5pc-pxrj-3893
More from Markus
9.1
CVE-2026-25057
Zip Slip in MarkUs config upload allowing RCE
8.8
CVE-2024-51743
MarkUs is a web application for the submission and grading of student assignments
8.8
CVE-2024-51499
MarkUs is a web application for the submission and grading of student assignments
6.5
CVE-2026-25962
MarkUs: Zip bomb in config upload enables DoS
6.5
CVE-2026-24900
MarkUs has a submission-view IDOR exposes all student submissions