Docsify vulnerable to cross-site scripting due to mishandled encoding

Description

docsify versions 4.12.1 and earlier are vulnerable to cross-site scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the " character.

Recommendation

Update the docsify package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.12.1
• Patched version(s): 4.12.2

References

• GHSA-5h7x-68wj-jhwc
• CVE-2021-30074
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Joplin vulnerable to Cross-site Scripting in notes - CVE-2021-37916
• materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input - CVE-2022-25349
• ckeditor4 vulnerable to cross-site scripting - CVE-2021-33829
• @claviska/jquery-minicolors vulnerable to Cross-site Scripting - CVE-2021-32850

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

docsify