# CVE-2022-35144: Raneto cross-site scripting vulnerability

Source: https://junglewise.ai/threats/cve-2022-35144-raneto-cross-site-scripting-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-35144 · Severity: low · CVSS 3.1 · Published 2022-08-05

Raneto is a popular open-source knowledge base and wiki platform. A cross-site scripting (XSS) vulnerability in version 0.17.0 and earlier could allow authenticated administrators to inject malicious scripts through search fields and file paths, potentially compromising user sessions or data when those pages are viewed by others. The vulnerability requires administrative access and user interaction, limiting its immediate risk but still requiring prompt patching.

Technologies: [raneto (npm)](https://junglewise.ai/threats/technologies/raneto). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-35144 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-35144 being exploited in the wild.

**How severe is CVE-2022-35144?** Low severity, with a CVSS score of 3.1, published 5 August 2022.

**Which products and versions are affected?** raneto (npm) SEMVER:introduced=0,fixed=0.17.1.

**Is there a fix for CVE-2022-35144?** Yes. raneto (npm): upgrade to 0.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-35144 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-35144?** Check whether you run raneto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- raneto (npm): upgrade to 0.17.1 or later

  ```sh
  npm install raneto@0.17.1
  ```


## Technical details

Raneto v0.17.0 and earlier contains a reflected/stored cross-site scripting (CWE-79) vulnerability in search sanitization and file path handling. The vulnerability allows authenticated administrators to inject unsanitized HTML/JavaScript through search functionality and page administration actions. An attacker with admin credentials can craft malicious payloads that execute in the browser context of users viewing affected pages. The issue is mitigated by the requirement for high-privilege (admin) access and user interaction (viewing a malicious page). The vulnerability was fixed in version 0.17.1, which implements proper HTML escaping and strips raw HTML in favor of Markdown-only content for new/updated pages.

## Affected products

- Ryan Lelek Raneto 0.17.0 and earlier; fixed in 0.17.1

## Identifiers

- CVE-2022-35144
- GHSA-vc68-6x72-w22f

## Timeline

- 2022-08-04: disclosed: Vulnerability disclosed by J-GainSec
- 2022-08-04: patched: Fixed in version 0.17.1 with security update PR #370

## References

- [https://github.com/ryanlelek/Raneto/pull/370](https://github.com/ryanlelek/Raneto/pull/370)

## Related threats

- [Raneto weak password complexity requirements](https://junglewise.ai/threats/cve-2022-35143-raneto-weak-password-complexity-requirements)
- [Raneto denial of service in search parameter](https://junglewise.ai/threats/cve-2022-35142-raneto-denial-of-service-in-search-parameter)