Read the Docs vulnerable to Cross-Site Scripting (XSS)

Description

This vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project.

Recommendation

Update the readthedocs package to the latest compatible version. Followings are version details:

• Affected version(s): < 8.8.1
• Patched version(s): 8.8.1

References

• GHSA-98pf-gfh3-x3mp
• CWE-79
• OWASP 2021-A3

Related Issues

• Nuxt DevTools vulnerable to cross-site scripting (XSS) - CVE-2025-52662
• TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements - CVE-2024-38357
• Cross-Site Scripting (XSS) in cloudcmd - Vulnerability
• TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option - CVE-2024-38356

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

Tags:

npm

readthedocs