Executive brief
Docsify is a popular documentation site generator used to create and host project documentation. The search feature in Docsify versions 4.12.1 and earlier fails to properly encode user input and special characters, allowing attackers to inject malicious JavaScript code. When a user performs a search that matches crafted payloads in documentation, the injected code executes in the browser, potentially compromising user sessions or stealing sensitive information.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the search plugin (search.js) affecting Docsify versions up to 4.12.1. The root cause is improper HTML encoding of search results, particularly in code block rendering and handling of double-quote characters ("). An attacker can craft documentation with malicious payloads (e.g., `xss"><img src=1 onerror=alert(1)><"`) that, when indexed and displayed in search results, execute arbitrary JavaScript in the victim's browser. The vulnerability requires no authentication and is triggered by user interaction with the search feature. The fix, implemented in version 4.12.2, adds proper HTML escaping using an `escapeHtml` function to sanitize search results before rendering.
Affected products
- Docsify docsify <=4.12.1
Timeline
- 2021-03-31: disclosed: Issue #1549 opened on GitHub
- 2021-04-12: patched: Fix merged in PR #1551; version 4.12.2 released
- 2022-05-24: advisory: GHSA advisory published