~ / search / GHSA-hwgp-c653-6684

GHSA-hwgp-c653-6684

GitBook allows Cross-site Scripting via a local .md file.

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-19596

Packages

EcosystemPackageAffectedFixed in
npm gitbook <= 2.6.9 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

GitBook through 2.6.9 allows Cross-site Scripting via javascript inclusion in a local .md file.

References

External links from the advisory. They lead to third-party sites.