CVE-2020-26298
Medium
Description
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Redcarpet
PublishedJan 11, 2021
First seenJan 11, 2021
Weakness typeCWE-74InjectionCWE-79Cross-site scripting (XSS)
How to fix
Update
- redcarpet_project redcarpet3.5.1 or later
Vendor advisories
- debian.org/security/2021/dsa-4831
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNO4ZZUPGAEUXKQL4G2HRIH7CUZKPCT6/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFMYDIONVWATY7EB6EARDVXT47AYCRNM/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXNNWHHAPREDM3XJDACYRTK7DBMUONBI/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redcarpet_project redcarpet | v < 3.5.1 | 3.5.1 |
| debian debian_linux | 9.0, 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.