What’s Vulnerable › Vulnerabilities

CVE-2020-11051: XSS in Wiki.js

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-05-05 · updated 2026-06-17
• Weakness: CWE-79

Description

In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the Markdown editor, the XSS payload will be executed as part of the preview panel. The rendered result does not contain the XSS payload as it is stripped by the HTML Sanitization security module. This vulnerability only impacts editors loading the malicious page in the Markdown editor. This has been patched in 2.3.81.

Affected products

• Requarks wiki: before 2.3.81 — fixed in 2.3.81

How to fix

Upgrade to a fixed version: Requarks wiki 2.3.81. Check the vendor advisory for mitigations.

References

• https://github.com/Requarks/wiki/commit/05e8a71ceff39167aee830ba8ad5eb0161f2911a
• https://github.com/Requarks/wiki/security/advisories/GHSA-vj72-c9vq-qxrv
• https://github.com/Requarks/wiki/commit/05e8a71ceff39167aee830ba8ad5eb0161f2911a
• https://github.com/Requarks/wiki/security/advisories/GHSA-vj72-c9vq-qxrv

Get alerted when CVE-2020-11051 or the next vulnerability affects your stack