CVE-2021-43842

Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5.257 and earlier are vulnerable to stored cross-site scripting through a SVG file upload. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute...

CVE-2021-43842

Wiki.js (Node.js-based wiki) versions ≤2.5.257 are vulnerable to stored XSS via crafted SVG file uploads. The attack executes JavaScript when the SVG is viewed, not when loaded in an tag. The fix (commit 5d3e81496fba1f0fbd64eeb855f30f69a9040718) adds optional SVG sanitization for uploads matchin...