CVE-2020-26298

Katalog CVE

CVSS 5.4 · Medium EPSS 1,6%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada redcarpet project redcarpet, debian linux. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.

Rincian

Terbit di NVD

11 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793 patch · advisory pihak ketiga
• https://github.com/advisories/GHSA-q3wr-qw3g-3p4h advisory pihak ketiga
• https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md#version-351-security release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/01/msg00014.html mailing list · advisory pihak ketiga
• https://rubygems.org/gems/redcarpet product · advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4831 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFMYDIONVWATY...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNO4ZZUPGAEUX...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXNNWHHAPREDM...