Read the docs
TI-2020-08925 Aliases CVE-2020-11051

XSS in Wiki.js

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the Markdown editor, the XSS payload will be executed as part of the preview panel. The rendered result does not contain the XSS payload as it is stripped by the HTML Sanitization security module. This vulnerability only impacts editors loading the malicious page in the Markdown editor. This has been patched in 2.3.81.

Why it matters now

EPSS 0.0061 49th percentileScored 2026-11-07
Fix Fixed Wiki.js (Requarks): 2.3.81

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RequarksWiki.jsbefore 2.3.812.3.81Patch availableCNA
  • Wiki.js VendorRequarks Affected before 2.3.81 Fixed in 2.3.81 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:requarks:wiki.js:*:*:*:*:*:*:*:*before 2.3.81VulnerableRequarks
  • cpe:2.3:a:requarks:wiki.js:*:*:*:*:*:*:*:* Versions before 2.3.81 Vulnerable ·Requarks

Remediation

  • Fix · CNA Wiki.js (Requarks) Fixed in 2.3.81

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11051

References

Patch 2

  • TI-2026-32203 Wiki.js: Privilege Escalation via Missing Group Validation in users.update CVSS 4.0HIGH 8.6
  • TI-2021-07999 Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor CVSS 3.1MEDIUM 5.4
  • TI-2025-35387 Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a… CVSS 3.1CRITICAL 9.1
  • TI-2020-12008 Directory Traversal in Wiki.js CVSS 3.1HIGH 8.6
  • TI-2022-07706 Improper write access check in Requarks/wiki CVSS 3.1HIGH 8.1
  • TI-2021-19662 Stored XSS in non-image uploads in Requarks/wiki CVSS 3.1HIGH 8.2
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences