Vulnerability · Published Feb 19, 2021 · Assigned by snyk
CVE-2021-23342Cross-site Scripting (XSS)
High 8.6
In plain English
A high-severity security flaw in docsify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)1.7%top 23.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | docsify | 4.12.0 | GHSA-2mm9-c2fx-c7m4 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-DOCSIFY-1066017 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076593 x_refsource_MISC
- https://github.com/docsifyjs/docsify/commit/ff2a66f12752471277fe81a64ad6c4b2c08111fe x_refsource_MISC
- 20210219 [KIS-2021-02] docsify <= 4.11.6 DOM-based Cross-Site Scripting Vulnerability mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html x_refsource_MISC