CVE-2020-26298 – Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, th …

Vuln ID: CVE-2020-26298

Published:  2021-01-11  19:15:13Z

Description: Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.

Source: NVD.NIST.GOV

 

Date:

Categorie(s):

Tag(s):