CVE-2020-4052 Stored XSS through template injection in Wiki.js

What is CVE-2020-4052?

CVE-2020-4052 is a medium-severity cross-site scripting vulnerability in Requarks.io Wiki.js, published on 16 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. This has been patched in 2.4.107.

Weakness: CWE-79

Which versions are affected by CVE-2020-4052?

It affects 1 product.

Products include Requarks Wiki.js.

How do I fix CVE-2020-4052?

No fix has been published for CVE-2020-4052 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-4052 being exploited?

There is no known exploitation of CVE-2020-4052 in the wild and no public exploit code.

Other vulnerabilities in Requarks.io Wiki.js

• CVE-2025-56643 Security feature bypass in n/a Critical 9.1
• CVE-2026-44224 Wiki.js: Privilege Escalation via Missing Group Validation in users.update High 8.6
• CVE-2020-15236 Directory Traversal in Wiki.js High 8.6
• CVE-2021-43855 Stored XSS via SVG in Requarks/wiki High 8.2
• CVE-2021-43856 Stored XSS in non-image uploads in Requarks/wiki High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9jgg-4xj2-vjjj.