Vulnerability · Published Apr 10, 2025 · Assigned by GitHub_M
CVE-2025-32391HedgeDoc allows XSS possibility through malicious SVG uploads
Medium 6.4
In plain English
A medium-severity cross-site scripting in hedgedoc from hedgedoc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.3, a malicious SVG file uploaded to HedgeDoc results in the possibility of XSS when opened in a new tab instead of the editor itself. The XSS is possible by exploiting the JSONP capabilities of GitHub Gist embeddings. Only instances with the local filesystem upload backend or special configurations, where the uploads are served from the same domain as HedgeDoc, are vulnerable. This vulnerability is fixed in 1.10.3. When upgrading to HedgeDoc 1.10.3 is not possible, instance owners could add the following headers for all routes under /uploads as a first-countermeasure: Content-Disposition: attachment and Content-Security-Policy: default-src 'none'. Additionally, the external URLs in the script-src attribute of the Content-Security-Policy header should be removed.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-3983-rrqh-mvx5 x_refsource_CONFIRM
- https://github.com/hedgedoc/hedgedoc/commit/0636b5c20b7097afccfa6641830352ad068ef964 x_refsource_MISC
- https://github.com/hedgedoc/hedgedoc/commit/3f520ea59abf912c66d7443cb99f29a567c47748 x_refsource_MISC
- https://github.com/hedgedoc/hedgedoc/commit/d2585fbd3b398b3359f6f88aa1fda8f4ecf2f78d x_refsource_MISC