Executive brief
GitBook is a documentation platform that renders markdown files into web content. This vulnerability allows an attacker to inject malicious JavaScript into markdown files, which is then executed in the browser of anyone viewing that documentation—potentially leading to session hijacking, credential theft, or malware distribution without requiring authentication from the attacker.
Technical details
This is a stored Cross-site Scripting (XSS) vulnerability (CWE-79) in GitBook versions through 2.6.9 where javascript code embedded in local .md (markdown) files is not properly sanitized before rendering. An attacker can place malicious script tags or event handlers in markdown files, and when GitBook processes and renders these files, the JavaScript executes in the context of viewers' browsers. The vulnerability requires local file access or the ability to modify markdown sources, and user interaction (viewing the affected page). Patches are available in versions after 2.6.9.
Affected products
- GitBook GitBook through 2.6.9
Timeline
- 2019-12-05: disclosed
- 2022-05-24: advisory