Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

mdBook

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2crates.ioPublished

    XSS in mdBook

    CVE-2020-26297 · GHSA-gx5w-rrhp-f436

    Affected
    • crates.io mdBook >= 0.1.4, < 0.4.5
    Fixed in
    0.4.5· Vendor fix available
    Issue
    This is a cross-post of [the official security advisory][ml]. The official post contains a signed version with our PGP key, as well. [ml]: https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0 The Rust Security Response Working Group was recently notified of a security issue affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code on the page. The CVE for this vulnerability is CVE-2020-26297. Overview The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query. Mitigations Owners of websites built with mdBook have to upgrade to mdBook 0.4.5 or…

    Recommended action: Upgrade to 0.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →