Is CVE-2021-30074 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-30074 being exploited in the wild.

How severe is CVE-2021-30074?

Low severity, with a CVSS score of 3.1, published 24 May 2022.

Which products and versions are affected?

docsify (npm) SEMVER:introduced=0,fixed=4.12.2.

Is there a fix for CVE-2021-30074?

Yes. docsify (npm): upgrade to 4.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-30074 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2021-30074?

Check whether you run docsify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-30074: Docsify cross-site scripting in search component

CVE-2021-30074 · Severity: low · CVSS 3.1 · Published 2022-05-24

Docsify is a popular documentation site generator used to create and host project documentation. The search feature in Docsify versions 4.12.1 and earlier fails to properly encode user input and special characters, allowing attackers to inject malicious JavaScript code. When a user performs a search that matches crafted payloads in documentation, the injected code executes in the browser, potentially compromising user sessions or stealing sensitive information.

Technologies: docsify (npm). Vendors: npm.

Quick answers

Is CVE-2021-30074 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-30074 being exploited in the wild.
How severe is CVE-2021-30074?: Low severity, with a CVSS score of 3.1, published 24 May 2022.
Which products and versions are affected?: docsify (npm) SEMVER:introduced=0,fixed=4.12.2.
Is there a fix for CVE-2021-30074?: Yes. docsify (npm): upgrade to 4.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-30074 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2021-30074?: Check whether you run docsify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

docsify (npm): upgrade to 4.12.2 or later
```
npm install docsify@4.12.2
```

Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the search plugin (search.js) affecting Docsify versions up to 4.12.1. The root cause is improper HTML encoding of search results, particularly in code block rendering and handling of double-quote characters ("). An attacker can craft documentation with malicious payloads (e.g., `xss"><img src=1 onerror=alert(1)><"`) that, when indexed and displayed in search results, execute arbitrary JavaScript in the victim's browser. The vulnerability requires no authentication and is triggered by user interaction with the search feature. The fix, implemented in version 4.12.2, adds proper HTML escaping using an `escapeHtml` function to sanitize search results before rendering.

Affected products

Docsify docsify <=4.12.1

Identifiers

CVE-2021-30074
GHSA-5h7x-68wj-jhwc

Timeline

2021-03-31: disclosed: Issue #1549 opened on GitHub
2021-04-12: patched: Fix merged in PR #1551; version 4.12.2 released
2022-05-24: advisory: GHSA advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.