Docsify XSS Vulnerability

Description

This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar.

Recommendation

Update the docsify package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.12.0
• Patched version(s): 4.12.0

References

• GHSA-2mm9-c2fx-c7m4
• snyk.io
• www.npmjs.com
• packetstormsecurity.com
• seclists.org
• CVE-2021-23342
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• XSS vulnerability allowing arbitrary JavaScript execution - CVE-2021-41174
• ghtml Cross-Site Scripting (XSS) vulnerability - CVE-2024-37166
• HTML comments vulnerability allowing to execute JavaScript code - CVE-2021-41165
• hexo-admin plugin for Node.js XSS Vulnerability - CVE-2019-17606

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

docsify