CVE-2021-28796: Cross-Site Scripting in Qiita-Markdown – CVSS 6.1 · Watchpost

← All vulnerabilities

Cross-Site Scripting in Qiita-Markdown

中危 6.1CVE-2021-28796 · GHSA-f2c9-5jqw-3xh3 · Published 18/03/2021 · updated 17/06/2026

要点

CVE-2021-28796 是影响 qiita-markdown, qiita (increments) 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.77%，高于 56.0% 的漏洞。
修复：升级到 0.33.0 或更高版本。

Package	Affected versions	Patched versions
qiita-markdown RubyGems	`< 0.33.0`	`0.33.0`
qiita increments	`< 0.33.0`	`0.33.0`

Description

Increments Qiita-Markdown before 0.33.0 allows XSS in transformers.

NVD description

Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.

References

nvd.nist.gov/vuln/detail/CVE-2021-28796 · ADVISORY
GitHub Advisory GHSA-f2c9-5jqw-3xh3 · ADVISORY
increments/qiita-markdown · PACKAGE
increments/qiita-markdown · WEB
rubysec/ruby-advisory-db · WEB
vuln.ryotak.me/advisories/15 · WEB

qiita-markdown 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free