TI-2021-06040 Aliases CVE-2021-23342 GHSA-2mm9-c2fx-c7m4

Cross-site scripting (XSS) in docsify

MEDIUM 41CWE-79Published 2021-02-19 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters

Why it matters now

EPSS 0.01657 76th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed docsify: 4.12.0docsify (npm): 4.12.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	docsify	before 4.12.0	4.12.0	Patch available	CNA
—	docsify (npm)	before 4.12.0	4.12.0	Patch available	GHSA-2mm9-c2fx-c7m4

docsify Vendor— Affected before 4.12.0 Fixed in 4.12.0 Patch available CNA
docsify (npm) Vendor— Affected before 4.12.0 Fixed in 4.12.0 Patch available GHSA-2mm9-c2fx-c7m4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:docsifyjs:docsify::::::::	before 4.12.0	Vulnerable	Docsifyjs

cpe:2.3:a:docsifyjs:docsify:*:*:*:*:*:*:*:* Versions before 4.12.0 Vulnerable ·Docsifyjs

Remediation

Fix · CNA docsify Fixed in 4.12.0
Fix · GHSA-2mm9-c2fx-c7m4 docsify (npm) Fixed in 4.12.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-23342
2026-10-03 Alias added: GHSA-2mm9-c2fx-c7m4

References

Exploit 1

http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html

Patch 1

https://github.com/docsifyjs/docsify/commit/ff2a66f12752471277fe81a64ad6c4b2c08111fe

Advisory 2

Other 1

https://www.npmjs.com/package/docsify

TI-2020-06200 Cross-site scripting in docsify CVSS 3.1MEDIUM 6.1
TI-2021-10652 docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences