CVE-2020-7680: Improper Neutralization of Input During Web Page Generation

docsify prior to 4.11.4 is susceptible to Cross-site Scripting XSS. Docsify.js uses fragment identifiers parameters after sign to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the // domain.com///attacker.com and render...

Cross-site Scripting (XSS)

Overview docsify is a magical documentation site generator. Affected versions of this package are vulnerable to Cross-site Scripting XSS. Docsify.js uses fragment identifiers parameters after sign to load resources from server-side .md files. Due to lack of validation here, it is possible to...

@shoplo/kit-vue (>=1.17.0, <=1.22.16), dm-cli (>=0.4.1-0, <=0.4.5) potentially affected by CVE-2020-7680 via docsify (>=4.2.1, <=4.9.1)

docsify NPM version =4.2.1, =1.17.0, =0.4.1-0, =0.4.5 Source cves: CVE-2020-7680 Source advisory: SNYK:JS-DOCSIFY-567099...