CVE-2020-26298mediumCWE-74CWE-79

CVE-2020-26298: falha de média gravidade em vmg redcarpet

Injection in Redcarpet

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar redcarpet+ Monitorar redcarpet

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 1.6%
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Produtos afetados
vmg · redcarpet