MEDIUM6.1

GHSA-5h5r-23r4-m87h

Cross-Site Scripting in gitbook

Quick fix

GHSA-5h5r-23r4-m87h — gitbook: upgrade to the fixed version with the command below.

npm install gitbook@3.2.2

Details

Affected versions of `gitbook` do not properly sanitize user input outside of backticks, which may result in cross-site scripting in the online reader.

## Recommendation

Update to version 3.2.2 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/gitbook

Introduced in: 0Fixed in: 3.2.2

Fixnpm install gitbook@3.2.2

References

https://nvd.nist.gov/vuln/detail/CVE-2017-16019[ADVISORY]
https://github.com/GitbookIO/gitbook/issues/1609[WEB]
https://www.npmjs.com/advisories/159[WEB]