CVE-2020-7680GHSA-QPQH-46QJ-VWCWSNYK-JS-DOCSIFY-567099
docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS).
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.11.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB
Summary
docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-48681
- Record last updated
Affected versions
- n/a docsify
All versions prior to 4.11.4
- docsifynpm
fixed in 4.11.4