Typemill, a flat‑file Markdown CMS, permits authenticated users with rights to edit page metadata to inject arbitrary HTML attributes into the og:title and og:description fields. Because the system does not perform output encoding, these attributes are rendered verbatim in meta tags, allowing the execution of scripts under certain browser or DOM interaction scenarios. The resulting stored XSS can compromise user sessions, enable cookie theft, or run arbitrary JavaScript on a visitor’s browser.

All Typemill installations using versions prior to 2.23.0 are affected. The flaw exists wherever users can edit the og:title or og:description metadata fields. Those running the default configuration without restricting metadata editing permissions are particularly vulnerable.

The CVSS score of 4.6 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user who can modify page metadata; an attacker can directly insert malicious attributes via the CMS interface. Because the attack chain does not entail arbitrary user input, it primarily depends on compromised credentials or insider access, making the risk moderate for exposed websites but potentially severe if an attacker gains edit rights.