Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

GovUK Tech Docs search page can run malicious code

published 2 years ago

Summary

Versions of GovUK Tech Docs from 2.0.2 up to before 3.3.1 let attackers place harmful code in search results, which could run in a visitor's browser. This could let attackers steal information or change what the user sees. Upgrade the software to version 3.3.1 or later to fix the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
RubyGems	government digital service	govuk_tech_docs	>= 2.0.2

Original advisory text

Duplicate Advisory: govuk_tech_docs vulnerable to unescaped HTML on search results page

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-x2xw-hw8g-6773. This link is maintained to preserve external references.

### Original Description
versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.

References

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published4 Jan 2024

Updated10 Sep 2026

First seen10 Sep 2026

Sources

GHSA-4mvm-xh8j-fv27 · OSV

Track software like this

Free during beta