CVE-2019-15618 — Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location

Matched remediation archetype

Cross-site scripting and unsafe browser output

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Trace reflected, stored, and DOM-derived untrusted values into HTML, attributes, URLs, styles, scripts, and client-side template sinks.
• Identify affected origins, authenticated user roles, sensitive browser capabilities, and where content is shared across tenants.
• Review framework escaping, rich-text sanitization, legacy templates, and client-side rendering paths.

Remediate safely

• Use context-aware framework output encoding and safe DOM APIs; keep untrusted data out of executable contexts.
• Sanitize intentionally supported markup with a maintained allowlist policy and validate URLs and attributes separately.
• Update affected rendering components and add tests for every output context using inert sentinel markup.