MEDIUM5.4
GHSA-rjmp-rwj4-mv82
@diplodoc/search-extension allows stored XSS via Markdown file title
Quick fix
GHSA-rjmp-rwj4-mv82 — @diplodoc/search-extension: upgrade to the fixed version with the command below.
npm install @diplodoc/search-extension@3.0.5Details
@diplodoc/search-extension 1.0.0 through 3.0.2 allows stored XSS via .md file title.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/@diplodoc/search-extension
Introduced in:
1.0.0Fixed in: 3.0.5Fix
npm install @diplodoc/search-extension@3.0.5References
- https://nvd.nist.gov/vuln/detail/CVE-2026-40201[ADVISORY]
- https://github.com/diplodoc-platform/search-extension/pull/41[WEB]
- https://github.com/diplodoc-platform/search-extension[PACKAGE]
- https://github.com/diplodoc-platform/search-extension/releases[WEB]
- https://github.com/diplodoc-platform/search-extension/releases/tag/v3.0.3[WEB]
- https://github.com/eyelessgoddd/eyelessgoddd/blob/main/README.md[WEB]