CVE-2021-23342

The CVE-2021-23342 entry concerns docsify before version 4.12.0, where a bypass of CVE-2020-7680 allows cross-site scripting. The vulnerability arises because HTML sanitization performed for remote URLs on the main page is not applied in the sidebar, and the isURL external check can be bypassed b...

CVE-2020-7680

Summary of CVE-2020-7680 (docsify XSS) Affected software: docsify prior to version 4.11.4 (docsify.js) which loads resources via fragment identifiers after # (e.g., domain.com/#//attacker.com) to server-side .md files. Root cause: insufficient validation of these fragment URLs allows rendering ar...