CVE-2020-7680: Cross-site Scripting in docsify
Summary
CVE-2020-7680: Cross-site Scripting in docsify. Affects docsify versions < 4.11.4. Fixed in 4.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
docsify is an npm package used for generating documentation websites from markdown files. It allows users to create dynamic and interactive documentation pages. However, prior to version 4.11.4, docsify is vulnerable to Cross-site Scripting (XSS) attacks. This vulnerability arises from the lack of validation in the handling of fragment identifiers (parameters after the # sign) when loading resources from server-side .md files. An attacker can exploit this vulnerability by providing external URLs after the /#/ in the domain, allowing them to inject arbitrary JavaScript or HTML code into the docsify page.
Vulnerability Detail
The Cross-site Scripting vulnerability in docsify allows an attacker to execute malicious scripts or inject arbitrary HTML code into the documentation pages. This can lead to various security risks, such as stealing sensitive user information, performing actions on behalf of the user, or redirecting users to malicious websites. The lack of proper validation of fragment identifiers enables an attacker to bypass security measures and execute unauthorized code within the context of the vulnerable page.
How To Fix
Latest published version: 5.0.0 as of 23 Oct 2026
npm install docsify@5.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.11.4
This is the first release that contains the fix.
npm install docsify@4.11.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually validate and sanitize the fragment identifiers before loading resources from server-side .md files. This can be achieved by implementing input validation and sanitization techniques, such as using regular expressions or HTML sanitization libraries. By properly validating and sanitizing the fragment identifiers, the risk of XSS attacks can be mitigated.
Conclusion
The Cross-site Scripting vulnerability in docsify can be mitigated by updating to version 4.11.4 or later. It is important to promptly apply this update to ensure the security of the application and protect against potential XSS attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for docsify →
FAQ
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or code into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information, performing actions on behalf of the user, or redirecting users to malicious websites.
The Cross-site Scripting vulnerability in docsify allows an attacker to inject and execute arbitrary JavaScript or HTML code within the context of the documentation pages. This can lead to unauthorized actions, data theft, or redirection to malicious websites.
Yes, the vulnerability has been fixed in docsify version 4.11.4. It is recommended to update to this version or later to ensure the security of the application.
There are no known public exploits of this vulnerability at the time of writing. However, it is important to promptly update to the latest version of docsify to mitigate the risk of potential attacks.
In addition to updating to the latest version of docsify, it is recommended to implement a Content Security Policy (CSP) to further mitigate the risk of XSS attacks. A CSP helps restrict the types of content that can be loaded and executed on a web page, reducing the attack surface for XSS vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for docsify.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
