HedgeDoc allowed the local‑part of user email addresses to be registered using RFC5321 quoted‑string syntax. The value was later reused directly as the user’s display name in HTML without escaping, a flaw that corresponds to CWE‑116 and further enables the classic DOM‑based XSS flaw identified as CWE‑79. This made it possible for an attacker to register a malicious email address, store arbitrary HTML fragments via the publish and slide views, and later have this markup rendered on pages viewed by other users. The injected markup could break out of HTML attributes and insert custom elements, including cross‑origin iframes; while inline JavaScript execution was mitigated by a deployed Content‑Security‑Policy, the ability to alter page content and embed external resources still constitutes a visible threat.

The vulnerability existed in HedgeDoc prior to version 1.11.0. All installations running HedgeDoc version 1.10.x or earlier, using the default user interface for publishing and slides, are affected. The vendor is the HedgeDoc open source project; the impacted product is the HedgeDoc collaborative markdown editor.

The CVSS score of 5.1 indicates a moderate impact. The EPSS score of <1% suggests that the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. The exploit path requires an attacker to register a new account with a crafted email address, after which any existing or future documents that reference that user will render the injected markup for all viewers. The attack is straightforward once the conditions are met and could have non‑repudiable effects on user experience and trust.