ASA-202101-8: mdbook: cross-site scripting
Arch Linux Security Advisory ASA-202101-8
========================================
Severity: Medium
Date : 2021-01-12
CVE-ID : CVE-2020-26297
Package : mdbook
Type : cross-site scripting
Remote : Yes
Link : https://security.archlinux.org/AVG-1399
Summary
======
The package mdbook before version 0.4.5-1 is vulnerable to cross-site
scripting.
Resolution
=========
Upgrade to 0.4.5-1.
# pacman -Syu "mdbook>=0.4.5-1"
The problem has been fixed upstream in version 0.4.5.
Workaround
=========
None.
Description
==========
The search feature of mdBook (introduced in version 0.1.4) was affected
by a cross site scripting vulnerability that allowed an attacker to
execute arbitrary JavaScript code on an user's browser by tricking the
user into typing a malicious search query, or tricking the user into
clicking a link to the search page with the malicious search query
prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping
the search query.
Impact
=====
A malicious user can execute arbitrary code in a user's browser with a
malicious search query.
References
=========
https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0
https://github.com/rust-lang/mdBook/commit/648c9ae772bec83f0a5954d17b4287d5bb1d6606
https://security.archlinux.org/CVE-2020-26297
A mdbook security update has been released for Arch Linux.