CVE-2024-34710

Published: May 20, 2024Modified: Jun 17, 2026Deferred

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.8 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.

Related CWEs

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

References (4)

https://github.com/requarks/wiki/commit/1238d614e1599fefadd4614ee4b5797a087f50ac

Source: security-advisories@github.com

https://github.com/requarks/wiki/security/advisories/GHSA-xjcj-p2qv-q3rf

Source: security-advisories@github.com

https://github.com/requarks/wiki/commit/1238d614e1599fefadd4614ee4b5797a087f50ac

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/requarks/wiki/security/advisories/GHSA-xjcj-p2qv-q3rf

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.