CVE-2020-26297

    Dashboard / Vulnerabilities / CVE-2020-26297

    CVE-2020-26297

    Published: 4 Jan 2021Last Modified: 9 Jul 2026

    Summary:

    Details: mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code on the page. The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query. Owners of websites built with mdBook have to upgrade to mdBook 0.4.5 or greater and rebuild their website contents with it.

    References: https://crates.io/crates/mdbook, https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-045, https://github.com/rust-lang/mdBook/security/advisories/GHSA-gx5w-rrhp-f436, https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0, https://github.com/rust-lang/mdBook/commit/32abeef088e98327ca0dfccdad92e84afa9d2e9b

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- c8bbfd4bc1473a4f680c519ffbcd1b8476432f17
    Fixed -f66df0932401e762bdfd4906e982af7b00af3bd9

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-26297 | CVE-DB