CVE-2019-19619: Cross-site Scripting in Documize
Summary
CVE-2019-19619: Cross-site Scripting in Documize. Affects github.com/documize/community versions < 3.5.1. Fixed in 3.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Documize is a Go package that provides a platform for creating and managing documentation. It allows users to write content using Markdown syntax, which is then rendered as HTML. This vulnerability affects versions prior to 3.5.1 of the 'github.com/documize/community' package. The package is widely used in various Go applications and is vulnerable to cross-site scripting (XSS) attacks when handling untrusted Markdown content.
Vulnerability Detail
The vulnerability originates from the 'domain/section/markdown/markdown.go' file in the Documize package. It mishandles untrusted Markdown content, allowing malicious actors to inject arbitrary HTML or JavaScript code into the rendered output. This can lead to various security risks, including the execution of malicious scripts in the context of other users' sessions, stealing sensitive information, or performing actions on behalf of the user without their consent. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: v3.2.0+incompatible as of 23 Oct 2026
go get github.com/documize/community@v3.2.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.1
This is the first release that contains the fix.
go get github.com/documize/community@v3.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible to mitigate the risk of exploitation.
Conclusion
In conclusion, the 'github.com/documize/community' package prior to version 3.5.1 is vulnerable to cross-site scripting (XSS) attacks. To mitigate this risk, it is crucial to update to version 3.5.1 or later, which includes the necessary security improvements. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/documize/community →
FAQ
This vulnerability allows attackers to inject malicious code into the rendered HTML output, potentially leading to the execution of arbitrary scripts, stealing sensitive information, or performing unauthorized actions on behalf of users.
While there is no specific information about known exploits, the presence of this vulnerability increases the risk of XSS attacks, which are commonly exploited by malicious actors.
No, only versions prior to 3.5.1 are affected. It is recommended to update to version 3.5.1 or later to fix the vulnerability.
Yes, this vulnerability can be exploited remotely by sending specially crafted Markdown content to the affected application.
Yes, the fix for this vulnerability is available in version 3.5.1 of the 'github.com/documize/community' package.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
