| Package | Affected versions | Patched versions |
|---|---|---|
| wiki.js | < 2.4.107 | 2.4.107 |
In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. This has been patched in 2.4.107.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free