MEDIUM6.1

GHSA-qpqh-46qj-vwcw

Cross-site Scripting in docsify

Quick fix

GHSA-qpqh-46qj-vwcw — docsify: upgrade to the fixed version with the command below.

npm install docsify@4.11.4

Details

docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/docsify

Introduced in: 0Fixed in: 4.11.4

Fixnpm install docsify@4.11.4

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7680[ADVISORY]
https://github.com/docsifyjs/docsify/issues/1126[WEB]
https://github.com/docsifyjs/docsify/pull/1128[WEB]
https://snyk.io/vuln/SNYK-JS-DOCSIFY-567099[WEB]
http://packetstormsecurity.com/files/158515/Docsify.js-4.11.4-Cross-Site-Scripting.html[WEB]
http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html[WEB]
http://seclists.org/fulldisclosure/2021/Feb/71[WEB]