Injection/XSS in Redcarpet
Published: January 11, 2021
SECURITY IDENTIFIERS
- CVE: CVE-2020-26298 (NVD)
- GHSA: GHSA-q3wr-qw3g-3p4h
- Vendor Advisory: https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793
GEM
SEVERITY
CVSS v3.x: 6.8 (Medium)
PATCHED VERSIONS
>= 3.5.1
DESCRIPTION
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before
version 3.5.1, there is an injection vulnerability which can enable a cross-site
scripting attack. In affected versions no HTML escaping was being performed when
processing quotes. This applies even when the :escape_html option was being used.