CVE-2020-26298: Injection in Redcarpet
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml option was being used. This is fixed in version 3.5.1 by the referenced commit.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-26298?
CVE-2020-26298 is a vulnerability in the Redcarpet Ruby library that allows for a cross-site scripting attack.
How does CVE-2020-26298 affect Redcarpet?
CVE-2020-26298 allows for HTML injection in Redcarpet, potentially enabling a cross-site scripting attack.
What is the severity of CVE-2020-26298?
The severity of CVE-2020-26298 is rated as medium, with a severity value of 6.8.
How can I fix CVE-2020-26298?
To fix CVE-2020-26298, update Redcarpet to version 3.5.1 or later.
Where can I find more information about CVE-2020-26298?
You can find more information about CVE-2020-26298 on the following references: [link 1](https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793), [link 2](https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md#version-351-security), [link 3](https://rubygems.org/gems/redcarpet).