npm docsify vulnerabilities

Latest npm docsify CVEs

Newest publication first

1. CVE-2021-30074 Docsify vulnerable to cross-site scripting due to mishandled encoding

   Published 2021-04-02

   Medium·CVSS 6.1

   docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the " character.

2. CVE-2021-23342 Cross-site Scripting (XSS)

   Published 2021-02-19

   Medium·CVSS 6.1 Public exploit

   This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization...

3. CVE-2020-7680 Cross-site Scripting in docsify

   Published 2020-07-20

   Medium·CVSS 6.1 EPSS 4.5% Public exploit

   docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.