Vulnerabilities > CVE-2020-26298

CVSS 5.4 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

redcarpet-project

debian

NVD

Published: 2021-01-11

Updated: 2024-11-21

Summary

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.

Vulnerable Configurations

Part	Description	Count
Application	Redcarpet_Project Redcarpet Project Redcarpet 1.17.2 Redcarpet Project Redcarpet 2.0.0 Redcarpet Project Redcarpet 2.0.1 Redcarpet Project Redcarpet 2.1.0 Redcarpet Project Redcarpet 2.1.1 Redcarpet Project Redcarpet 2.2.0 Redcarpet Project Redcarpet 2.2.1 Redcarpet Project Redcarpet 2.2.2 Redcarpet Project Redcarpet 2.3.0 Redcarpet Project Redcarpet 3.0.0 Redcarpet Project Redcarpet 3.1.0 Redcarpet Project Redcarpet 3.1.1 Redcarpet Project Redcarpet 3.1.2 Redcarpet Project Redcarpet 3.2.0 Redcarpet Project Redcarpet 3.2.1 Redcarpet Project Redcarpet 3.2.2 Redcarpet Project Redcarpet 3.2.3 Redcarpet Project Redcarpet 3.3.0 Redcarpet Project Redcarpet 3.3.1 Redcarpet Project Redcarpet 3.3.2 Redcarpet Project Redcarpet 3.3.3 Redcarpet Project Redcarpet 3.3.4 Redcarpet Project Redcarpet 3.4.0 Redcarpet Project Redcarpet 3.5.0	24
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0	2

Vulnerabilities > CVE-2020-26298 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2020-26298"}]}

Summary

Vulnerable Configurations

References

Vulnerabilities > CVE-2020-26298