CVE-2026-126945
HIGH
NVD
CVSS Score
8.7
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.