Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

readthedocs

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmAmendedPublished

    Read the Docs vulnerable to Cross-Site Scripting (XSS)

    GHSA-98pf-gfh3-x3mp

    Affected
    • npm readthedocs < 8.8.1
    Fixed in
    8.8.1· Vendor fix available
    Issue
    Impact This vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project. Exploiting this would have required the attacker to get a logged-in user to visit the malicious URL, which would have allowed the attacker to take control of the user's session with JavaScript (making requests to the API/site on behalf of the user). This URL would have looked something like hxxps[:]//readthedocs[.]org/projects/attacker-project/downloads/html/version-with-javascript-attack/. Patches This issue has been patched in our 8.8.1 release.

    Recommended action: Upgrade to 8.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →