| Package | Affected versions | Patched versions |
|---|---|---|
| docs | ≥ 3.8.0, < 4.3.0 | 4.3.0 |
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free