Executive brief
@diplodoc/search-extension is an npm library used to add search capabilities to documentation sites built with Diplodoc. The library contains a stored cross-site scripting (XSS) vulnerability in how it processes Markdown file titles, allowing an attacker to inject malicious code into documentation that executes when viewed by other users. This could compromise user sessions, steal credentials, or deface documentation pages.
Technical details
The vulnerability is a stored XSS flaw (CWE-79) present in @diplodoc/search-extension versions 1.0.0 through 3.0.2. The root cause is insufficient sanitization of Markdown file titles when indexing or rendering search results. An attacker can craft a .md file with a malicious title containing JavaScript code; when the search index processes and displays this title, the script executes in the context of other users' browsers. The attack requires the ability to add or modify Markdown files in the documentation source. The vulnerability was patched in version 3.0.5 and later, as evidenced by the fix merged in pull request #41.
Affected products
- diplodoc-platform @diplodoc/search-extension 1.0.0 through 3.0.2
Timeline
- 2026-05-01: disclosed: Advisory published
- 2026-05-07: patched: Fix available in version 3.0.5 and later
- 2026-04-23: other: Fix PR #41 merged