PT-2024-40529 · Unknown · Readthedocs-Sphinx-Search

Published 2024-01-16 · Updated 2024-01-16

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: readthedocs-sphinx-search versions prior to 0.3.2

Description: This issue could have allowed an attacker to include arbitrary HTML content in search results by having a user search a malicious project. The problem was due to the search client not correctly escaping all user content from search results. There have been no signs that this issue was exploited in the wild.

Recommendations: For versions prior to 0.3.2, update to version 0.3.2 and trigger a new build. As a temporary workaround, consider restricting the use of the search function until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-XGFM-FJX6-62MJ

Affected Products

Readthedocs-Sphinx-Search

References · 4

• https://osv.dev/vulnerability/GHSA-xgfm-fjx6-62mj · Vendor Advisory
• https://github.com/readthedocs/readthedocs-sphinx-search · Note
• https://github.com/readthedocs/readthedocs-sphinx-search/commit/8c6f6d01e88e72ef32ed0c220b6c19d1e1121c73 · Note
• https://github.com/readthedocs/readthedocs-sphinx-search/security/advisories/GHSA-xgfm-fjx6-62mj · Note