A high-severity cross-site scripting vulnerability in MarkUs versions prior to 2.9.1 poses a significant risk of unauthorized script execution within the context of the application.

The application fails to sanitize content from student-submitted files at the courses/:course_id/assignments/:assignment_id/submissions/html_content endpoint, leading to a stored cross-site scripting (XSS) vulnerability that requires low-privileged user access.

Successful exploitation allows an attacker to execute malicious scripts in the browser of other users, including instructors or administrators. This can lead to session hijacking, unauthorized access to sensitive grading information, or the modification of assignment data. With a CVSS score of 8.0, the vulnerability represents a high risk to the integrity and confidentiality of the student grading platform.

Immediate Action: Upgrade MarkUs to version 2.9.1 or later to implement the necessary input sanitization fixes.

Proactive Monitoring: Review web server and application access logs for unusual requests directed at the submission preview endpoints, specifically looking for script tags or encoded payloads.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter common XSS attack patterns in incoming traffic.

Public Exploit Available: No (exploit_available: false)

The vulnerability in the MarkUs application presents a clear path for malicious actors to compromise user sessions and data integrity. Organizations should prioritize the update to version 2.9.1 immediately. Given the nature of the platform as a repository for academic assignments, failing to patch this flaw could lead to widespread exposure of student data and grading records.