GitStock

vmg/redcarpet · Security

Injection/XSS in Redcarpet

GHSA ID
GHSA-q3wr-qw3g-3p4h
CVE ID
CVE-2020-26298
Severity
medium
Published
Updated
CVSS
6.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
CVSS v3
6.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Description

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escape_html option was being used. This is fixed in version 3.5.1 by the referenced commit.

CWEs

  • CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References