From 6cbe6087cdd74b6b45cabc8e55863c9b4a90f748 Mon Sep 17 00:00:00 2001
From: Shakeel Bhat <shakeelurrehman.bhat@crowdstrike.com>
Date: Mon, 27 Jul 2026 22:52:45 +0530
Subject: [PATCH] fix: sanitize injectHead and injectBody to prevent site-wide
 stored XSS

---
 server/graph/resolvers/theming.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/graph/resolvers/theming.js b/server/graph/resolvers/theming.js
index 3a175c0f..3e2d1cd6 100644
--- a/server/graph/resolvers/theming.js
+++ b/server/graph/resolvers/theming.js
@@ -47,8 +47,8 @@ module.exports = {
           darkMode: args.darkMode,
           tocPosition: args.tocPosition || 'left',
           injectCSS: args.injectCSS || '',
-          injectHead: args.injectHead || '',
-          injectBody: args.injectBody || ''
+          injectHead: args.injectHead ? args.injectHead.replace(/<script/gi, '') : '',
+          injectBody: args.injectBody ? args.injectBody.replace(/<script/gi, '') : ''
         }
 
         await WIKI.configSvc.saveToDb(['theming'])