Arch Linux Security Advisory ASA-202101-8

Severity: Medium
Date : 2021-01-12
CVE-ID : CVE-2020-26297
Package : mdbook
Type : cross-site scripting
Remote : Yes
Link : https://security.archlinux.org/AVG-1399

Summary

The package mdbook before version 0.4.5-1 is vulnerable to cross-site
scripting.

Resolution

Upgrade to 0.4.5-1.

pacman -Syu “mdbook>=0.4.5-1”

The problem has been fixed upstream in version 0.4.5.

Workaround

None.

Description

The search feature of mdBook (introduced in version 0.1.4) was affected
by a cross site scripting vulnerability that allowed an attacker to
execute arbitrary JavaScript code on an user’s browser by tricking the
user into typing a malicious search query, or tricking the user into
clicking a link to the search page with the malicious search query
prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping
the search query.

Impact

A malicious user can execute arbitrary code in a user’s browser with a
malicious search query.

References

https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0
https://github.com/rust-lang/mdBook/commit/648c9ae772bec83f0a5954d17b4287d5bb1d6606
https://security.archlinux.org/CVE-2020-26297