The vulnerability resides in the OtterwikiMdRenderer.block_code function and allows an attacker who can edit a wiki page to insert a math fenced code block containing unescaped HTML. When the page is viewed, the malicious script executes in the context of the viewer’s browser, providing the attacker with the ability to hijack sessions, deface the site, or inject malicious content. This is a classic stored XSS flaw (CWE‑79) that can be exploited whenever page editing privileges are available, including for anonymous users under the default configuration.

The weakness affects all installations of Otter Wiki older than version 2.26.2. The product is distributed by redimp under the vendor name redimp:otterwiki. Users running any release prior to 2.26.2—including 2.25, 2.24, or earlier—are potentially vulnerable if they allow page edits. No specific sub‑version scope is limited beyond the stated cutoff.

The CVSS score of 5.3 classifies the flaw as medium severity. EPSS data is not available, and the vulnerability is not present in the CISA KEV catalog. The attack vector is inferred to be stored XSS executed when an authenticated or anonymous editor injects a math code block into a page; audience exposure is to any viewer of the page, making the risk significant for sites with wide public access. Mitigation requires patching or restricting editing capabilities.