CVE-2017-16019: Cross-Site Scripting in gitbook
Summary
CVE-2017-16019: Cross-Site Scripting in gitbook. Affects gitbook versions < 3.2.2. Fixed in 3.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitbook is an open-source tool used for creating and publishing documentation. It allows users to write content in Markdown and generate static websites or ebooks. The vulnerability in gitbook allows for cross-site scripting (XSS) attacks in the online reader. This occurs due to improper sanitization of user input outside of backticks.
Vulnerability Detail
The affected versions of gitbook do not properly sanitize user input, which can lead to the execution of malicious scripts in the online reader. An attacker could exploit this vulnerability by injecting malicious code into the content, potentially compromising the security and integrity of the application. This vulnerability has a low severity rating (CWE-79) and has been assigned the identifier GHSA-5h5r-23r4-m87h.
How To Fix
Latest published version: 2.6.9 as of 22 Oct 2026
npm install gitbook@2.6.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.2
This is the first release that contains the fix.
npm install gitbook@3.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the gitbook vulnerability allows for cross-site scripting (XSS) attacks in the online reader. It is important to update gitbook to version 3.2.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for gitbook →
FAQ
Gitbook is an open-source tool used for creating and publishing documentation. It allows users to write content in Markdown and generate static websites or ebooks.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the theft of sensitive information or the execution of unauthorized actions.
The gitbook vulnerability allows for cross-site scripting (XSS) attacks in the online reader. This means that an attacker could inject malicious code into the content, potentially compromising the security and integrity of the application.
This vulnerability has a low severity rating (CWE-79), indicating that it has the potential to cause some harm but is not highly critical.
To protect your application, it is recommended to update gitbook to version 3.2.2 or later. This update includes proper sanitization of user input, preventing the execution of malicious scripts.
References
Related vulnerabilities
Recent vulnerabilities recorded for gitbook.
