The Diplodoc Search Extension versions 1.0.0 through 3.x before 3.0.3 can store malicious scripts in the title field of markdown (.md) files. When the extension renders these files, the injected script is executed in the browser, allowing an attacker to execute arbitrary client‑side code in the context of legitimate users who view the file. This flaw falls under CWE‑79 and can lead to credential theft, session hijacking, and phishing attacks.

The vulnerability affects the diplodoc-platform Search Extension. All installations using any release from 1.0.0 up to, but not including, 3.0.3 are potentially exploitable. A release starting with v3.0.3 contains the fix.

The CVSS score of 5.4 indicates a medium severity. While no EPSS value is available and the flaw is not listed in KEV, the stored XSS nature means successful exploitation requires a user to load a malicious markdown file that the extension processes. The likely attack path involves an attacker adding or modifying a .md file with a crafted title containing JavaScript that is later rendered by the extension.