Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2020-26287: HedgeDoc before 1.7.1: Malicious scripts can be injected through diagrams
CVE-2020-26287 · published 5 years ago
Summary
A security issue in HedgeDoc's collaborative platform allows attackers to inject malicious scripts in notes using diagrams. This can lead to unauthorized actions, such as creating or editing notes without authentication. To protect yourself, update to HedgeDoc 1.7.1 or adjust your Content-Security-Policy to block Google Analytics scripts.
What to do
- Update hedgedoc hedgedoc to version 1.7.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hedgedoc | hedgedoc |
< 1.7.1 cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:* |
Original advisory text
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our ...
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but `www.google-analytics.com` is allowed. Using Google Tag Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.1. As a workaround one can disallow `www.google-analytics.com` in the `Content-Security-Policy` header. Note that other ways to leverage the `script` tag injection might exist.
References
- https://github.com/hackmdio/codimd/issues/1630 Third Party Advisory
- https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.md Exploit Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc10... Patch Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published29 Dec 2020
Updated31 Oct 2026
First seen9 Jul 2026
Track software like this
Free during beta