Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

deno_doc

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.0crates.ioPublished

    deno_doc's HTML generator vulnerable to Cross-site Scripting

    CVE-2024-32468 · GHSA-qqwr-j9mm-fhw6

    Affected
    • crates.io deno_doc < 0.119.0
    Fixed in
    0.119.0· Vendor fix available
    Issue
    Several cross-site scripting vulnerabilities existed in the denodoc crate which lead to Self-XSS with deno doc --html. Details & PoC 1.) XSS in generated searchindex.js denodoc outputed a JavaScript file for searching. However, the generated file used innerHTML on unsanitzed HTML input. https://github.com/denoland/denodoc/blob/dc556c848831d7ae48f3eff2ababc6e75eb6b73e/src/html/templates/pages/search.js#L120-L144 2.) XSS via property, method and enum names denodoc did not sanitize property names, method names and enum names. Impact The first XSS most likely didn't have an impact since deno doc --html is expected to be used locally with own packages.

    Recommended action: Upgrade to 0.119.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →