CVE-2019-19619: Cross-site Scripting in Documize
Summary
CVE-2019-19619: Cross-site scripting in github.com/documize/community. Affects github.com/documize/community versions < 1.76.3-0.20191119114751-a4384210d4d0. Fixed in 1.76.3-0.20191119114751-a4384210d4d0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Documize is a Go package that provides a platform for creating and managing documentation. It allows users to write content in Markdown format, which is then rendered and displayed on the platform. However, prior to version 3.5.1, Documize mishandled untrusted Markdown content, making it vulnerable to cross-site scripting (XSS) attacks. This means that an attacker could inject malicious code into the rendered HTML, potentially leading to the execution of arbitrary scripts in the context of the user's browser.
Vulnerability Detail
The vulnerability in Documize arises from the improper handling of untrusted Markdown content. By not properly sanitizing the input, an attacker can inject malicious code into the rendered HTML. This can result in various consequences, including the theft of sensitive information, session hijacking, defacement of the website, or the propagation of malware to other users. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: v3.2.0+incompatible as of 23 Oct 2026
go get github.com/documize/community@v3.2.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.76.3-0.20191119114751-a4384210d4d0
This is the first release that contains the fix.
go get github.com/documize/community@v1.76.3-0.20191119114751-a4384210d4d0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of Documize is not immediately feasible, a temporary workaround is to manually sanitize the Markdown content before rendering it. This can be done using the bluemonday HTML sanitizer library. Here is an example of how to use the sanitizer in Go:
github.com/microcosm-cc/bluemonday
func sanitizeMarkdown(markdown string) string {
p := bluemonday.UGCPolicy()
return p.Sanitize(markdown)
}
Conclusion
In conclusion, the vulnerability in Documize allows for cross-site scripting attacks due to the mishandling of untrusted Markdown content. To mitigate this vulnerability, it is crucial to update to version 3.5.1 or later, which includes the necessary fixes. Additionally, following secure coding practices and regularly monitoring for security updates is essential. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/documize/community →
FAQ
The vulnerability allows an attacker to inject malicious code into the rendered HTML, potentially leading to various consequences such as data theft, session hijacking, website defacement, or the propagation of malware.
To protect your Documize installation, it is crucial to update to version 3.5.1 or later, which includes the necessary fixes for this vulnerability. Additionally, it is recommended to regularly monitor for security updates and follow best practices for secure coding and input validation.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability in Documize. However, it is always important to promptly apply security updates to mitigate the risk of potential exploits.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
For more information about this vulnerability, you can refer to the official GitHub advisory at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-wmwp-pggc-h4mj/GHSA-wmwp-pggc-h4mj.json
