CVE-2020-26297 json
XSS in mdBook's search page
published 2021-01-04 5 y ago modified 2026-09-10 1 mo ago also GHSA-gx5w-rrhp-f436 , RUSTSEC-2021-0001 , EUVD-2021-1733
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code on the page. The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query. Owners of websites built with mdBook have to upgrade to mdBook 0.4.5 or greater and rebuild their website contents with it.
Patch / fix
- crates.io mdBook 0.4.5
- crates.io mdbook 0.4.5
- rust-lang mdbook 0.4.5
- mdbook Arch Linux 0.4.5-1
arch linux advisories AVG-1399
Exploit prediction
1.27% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | mdBook | >=0.1.4, <0.4.5 |
0.4.5 |
| crates.io | mdbook | >=0.1.4-0, <0.4.5 |
0.4.5 |
Affected products
- rust-lang mdBook
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/rust-lang/mdBook/commit/32abeef088e98327ca0dfccdad92e84afa9d2e9b
web, patch, third-party-advisory
-
github.com
/rust-lang/mdBook/security/advisories/GHSA-gx5w-rrhp-f436
web, mitigation, third-party-advisory
-
groups.google.com
/g/rustlang-security-announcements/c/3-sO6of29O0
web, mailing-list, third-party-advisory
-
crates.io
/crates/mdbook
product, third-party-advisory, package
-
github.com
/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-045
web, release-notes, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-26297
advisory
-
github.com
/rust-lang/mdBook
package
-
rustsec.org
/advisories/RUSTSEC-2021-0001.html
web, advisory
Sources
- CVE List CVE-2020-26297
- GitHub Advisory GHSA-gx5w-rrhp-f436
- NVD CVE-2020-26297
- OSV RUSTSEC-2021-0001
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.