CVE-2026-24127 PUBLISHED

Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template login.twig of versions 2.19.1 and below. The username value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.

• https://github.com/typemill/typemill/security/advisories/GHSA-65x4-pjhj-r8wr
• https://github.com/typemill/typemill/commit/b506acd11e80fb9c8db5fa6c2c8ad73580b4e88c
• https://github.com/typemill/typemill/releases/tag/v2.19.2

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE
• CWE-116: Improper Encoding or Escaping of Output CWE