CVE-2026-41653: BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration

Severity: high (CVSS 7.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-07 · updated 2026-10-26
Weakness: CWE-79

Description

BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may be able to execute arbitrary JavaScript in certain circumstances in Markdown to PDF Tool. This issue has been patched in version 2.8.3.

Affected products

alam00000 bentopdf: before 2.8.3

References

https://github.com/alam00000/bentopdf/releases/tag/v2.8.3
https://github.com/alam00000/bentopdf/security/advisories/GHSA-6vh8-4frx-647f

Get alerted when CVE-2026-41653 or the next vulnerability affects your stack