PT-2020-16367 · Mit Scratch · Scratch Addons

Apple502J · Published 2020-11-23 · Updated 2020-12-03 · CVE-2020-26239

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Scratch Addons versions prior to 1.3.2

Description The issue is related to a DOM-based XSS vulnerability. When a victim visits a specific website, the More Links addon of the Scratch Addons extension incorrectly uses a regular expression, causing HTML-escaped values to be unescaped and leading to XSS.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 to fix the bug, as the extension will be automatically updated by the browser. As a temporary workaround, consider disabling the More Links addon via the extension's options until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-26239

GHSA-6QFQ-PX3R-XJ4P

Affected Products

Scratch Addons

References · 7

• https://github.com/ScratchAddons/ScratchAddons/security/advisories/GHSA-6qfq-px3r-xj4p · Patch
• https://github.com/ScratchAddons/ScratchAddons/commit/b9a52d6532c8514254c7cc1d8e18710dbedc41ff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26239 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26239 · Vendor Advisory
• https://github.com/ScratchAddons/ScratchAddons/blob/a471893df403f86c9182970678175d4772a0690c/addons/more-links/userscript.js#L15 · Note
• https://github.com/ScratchAddons/ScratchAddons/releases/tag/v1.3.2 · Note
• https://t.me/cibsecurity/16733 · Telegram Post