CVE-2021-23342 Cross-site Scripting (XSS)
Attackers can execute malicious JavaScript via unsanitized sidebar HTML or URL bypasses in the docsify documentation library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23342?
CVE-2021-23342 is a high-severity cross-site scripting vulnerability in docsify, published on 19 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters
Weakness: CWE-79
Which versions are affected by CVE-2021-23342?
2 open source packages ship an affected version, including docsify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
docsify npm | All versions | 4.12.0 |
docsify npm | All versions | 4.12.0 |
Products include Docsifyjs Docsify.
How do I fix CVE-2021-23342?
Upgrade docsify to 4.12.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-23342 being exploited?
There is no known exploitation of CVE-2021-23342 in the wild and no public exploit code.
Other vulnerabilities in docsify
Sources
Also known as GHSA-2mm9-c2fx-c7m4.