CVE-2020-26298 Injection in Redcarpet
An injection vulnerability in the Redcarpet Ruby library allows attackers to perform cross-site scripting attacks by bypassing HTML escaping mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26298?
CVE-2020-26298 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 11 Jan 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.
Which versions are affected by CVE-2020-26298?
2 open source packages ship an affected version, including redcarpet. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
redcarpet RubyGems | All versions | 3.5.1 |
redcarpet RubyGems | All versions | 3.5.1 |
Products include Debian Debian Linux, Redcarpet Project Redcarpet.
How do I fix CVE-2020-26298?
Upgrade redcarpet to 3.5.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-26298 being exploited?
There is no known exploitation of CVE-2020-26298 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-26298, DLA-2526-1, DSA-4831-1, GHSA-q3wr-qw3g-3p4h, OESA-2021-1175.