要点
- CVE-2017-16019 是影响 gitbook (gitbook), gitbook 的中危 (CVSS 6.1)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.92%，高于 60.6% 的漏洞。
- 修复：升级到 3.2.2 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| gitbook | < 3.2.2
| 3.2.2
|
| gitbook npm | < 3.2.2
| 3.2.2
|
Description
Affected versions of gitbook do not properly sanitize user input outside of backticks, which may result in cross-site scripting in the online reader.
Recommendation
Update to version 3.2.2 or later.
NVD description
GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free