CVE-2019-19619: Cross-site scripting in github.com/documize/community
Summary
CVE-2019-19619: Cross-site scripting in github.com/documize/community. Affects github.com/documize/community versions < 1.76.3-0.20191119114751-a4384210d4d0. Fixed in 1.76.3-0.20191119114751-a4384210d4d0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/documize/community is written in Go and is part of the Documize community project. It provides functionality for rendering HTML content in markdown. The package is vulnerable to a cross-site scripting (XSS) attack when rendering untrusted user input. This occurs because the HTML content in markdown is not properly sanitized during rendering.
Vulnerability Detail
The vulnerability allows an attacker to inject malicious HTML or JavaScript code into the rendered output, which can then be executed by unsuspecting users. This can lead to various security risks, including the theft of sensitive information, session hijacking, or the manipulation of website content. The vulnerability originates from the lack of proper input sanitization in the rendering process of markdown content.
How To Fix
Latest published version: v3.2.0+incompatible as of 23 Oct 2026
go get github.com/documize/community@v3.2.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.76.3-0.20191119114751-a4384210d4d0
This is the first release that contains the fix.
go get github.com/documize/community@v1.76.3-0.20191119114751-a4384210d4d0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to manually sanitize the user input before passing it to the rendering function. This can be done by using a trusted HTML sanitization library or by implementing custom sanitization logic. Here is an example of how to sanitize user input using the Go package 'bluemonday':
github.com/documize/community/domain/section/markdown
import (
"github.com/microcosm-cc/bluemonday"
)
func Render(input string) string {
// Sanitize user input
p := bluemonday.UGCPolicy()
sanitizedInput := p.Sanitize(input)
// Render sanitized input
// ...
}
Conclusion
In conclusion, the package github.com/documize/community is vulnerable to a cross-site scripting (XSS) attack when rendering untrusted user input. To mitigate this vulnerability, it is crucial to update the package to version 1.76.3-0.20191119114751-a4384210d4d0 or later. If immediate updating is not possible, manual sanitization of user input can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/documize/community →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of the affected user's browser. This can lead to various security risks, including the theft of sensitive information, session hijacking, or the manipulation of website content.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide the necessary information about your application, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a fix is available for this vulnerability. It is recommended to update the package to version 1.76.3-0.20191119114751-a4384210d4d0 or later, which includes the necessary fixes to properly sanitize the HTML content during rendering.
If updating the package is not immediately feasible, a temporary workaround is to manually sanitize the user input before passing it to the rendering function. This can be done by using a trusted HTML sanitization library or by implementing custom sanitization logic.
You can find more information about this vulnerability in the Open Source Vulnerability database at https://pkg.go.dev/vuln/GO-2021-0086.
