Vulnerability · Published Mar 18, 2021 · Assigned by GitHub_M

CVE-2021-21383XSS in Wiki.js

High 7.6

In plain English

A high-severity cross-site scripting in wiki from Requarks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)1.0%top 37.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Wiki.js an open-source wiki app built on Node.js. Wiki.js before version 2.5.191 is vulnerable to stored cross-site scripting through mustache expressions in code blocks. This vulnerability exists due to mustache expressions being parsed by Vue during content injection even though it is contained within a `<pre>` element. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. For an example see referenced GitHub Security Advisory. Commit 5ffa189383dd716f12b56b8cae2ba0d075996cf1 fixes this vulnerability by adding the v-pre directive to all `<pre>` tags during the render.

Affected products (as reported)

Vendor	Product	Versions
Requarks	wiki	< 2.5.191

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

References

https://github.com/Requarks/wiki/security/advisories/GHSA-6xx4-m8gx-826r x_refsource_CONFIRM
https://github.com/Requarks/wiki/commit/5ffa189383dd716f12b56b8cae2ba0d075996cf1 x_refsource_MISC
https://github.com/Requarks/wiki/releases/tag/2.5.191 x_refsource_MISC