CVE-2026-44401

# start typemill: if relative link or media-link
$href = $matches[1];
if($href[0] == '/')
{
    $href = $this->baseUrl . $href;
}
elseif(substr( $href, 0, 6 ) === "media/")
{
    $href = $this->baseUrl . '/' . $href;
}
# end typemill

$Element['attributes']['href'] = $href;   // <-- no scheme validation

              # end typemill
-
+
+             # block dangerous URI schemes (e.g. javascript:, vbscript:, data:)
+             $scheme = parse_url($href, PHP_URL_SCHEME);
+             if ($scheme !== null && !in_array(strtolower($scheme), ['http', 'https', 'mailto', 'ftp'], true))
+             {
+                 $href = '#';
+             }
+
              $Element['attributes']['href'] = $href;

# Offline: exercises the parser directly against a Typemill checkout
# (composer install already run, so vendor/ exists)
python3 CVE-2026-44401_POC.py local --source /path/to/typemill

# ...or straight against a running container, same way it was originally verified
python3 CVE-2026-44401_POC.py local --docker typemill --container-path /var/www/html

# Live: logs in, stores the payload via the theme-settings API, confirms the
# raw javascript: href on the public homepage, restores the original value
python3 CVE-2026-44401_POC.py remote --url http://localhost:8080 \
    --username admin --password '********'

php -r '
  require "vendor/autoload.php";
  require "system/typemill/Extensions/ParsedownExtension.php";
  $p = new \Typemill\Extensions\ParsedownExtension("",[],null);
  echo $p->markup($p->text("[x](javascript:alert(1))"));
'
# vulnerable: <p><a href="javascript:alert(1)">x</a></p>
# patched:    <p><a href="#">x</a></p>