Vulnerability · Published Jul 20, 2020 · Assigned by snyk
CVE-2020-7680
Medium 6.1
In plain English
A medium-severity security flaw in docsify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.5% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)4.5%top 8.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | docsify | 4.11.4 | GHSA-qpqh-46qj-vwcw |
Affected products (as reported)
References
- https://github.com/docsifyjs/docsify/issues/1126 x_refsource_MISC
- https://github.com/docsifyjs/docsify/pull/1128 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JS-DOCSIFY-567099 x_refsource_MISC
- http://packetstormsecurity.com/files/158515/Docsify.js-4.11.4-Cross-Site-Scripting.html x_refsource_MISC
- 20210219 [KIS-2021-02] docsify <= 4.11.6 DOM-based Cross-Site Scripting Vulnerability mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html x_refsource_MISC