GHSA-qpqh-46qj-vwcw

Cross-site Scripting in docsify

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7680

Packages

Ecosystem	Package	Affected	Fixed in
npm	docsify	< 4.11.4	4.11.4

Details

As written in the advisory (Markdown source, shown as plain text).

docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7680 advisory
https://github.com/docsifyjs/docsify/issues/1126 web
https://github.com/docsifyjs/docsify/pull/1128 web
https://snyk.io/vuln/SNYK-JS-DOCSIFY-567099 web
http://packetstormsecurity.com/files/158515/Docsify.js-4.11.4-Cross-Site-Scripting.html web
http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html web
http://seclists.org/fulldisclosure/2021/Feb/71 web