Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2026-28405

MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions

Description

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content route reads the contents of a student-submitted file and renders them without sanitization. This issue has been patched in version 2.9.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MarkUsProject Markus

  • < 2.9.1affected

References