CVE-2021-23342

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-233437.5All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitP CVE-2021-233449.8The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.CVE-2021-233455.3All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html end CVE-2021-233465.3This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause CVE-2021-233474.8The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO CVE-2021-233488.8This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function, it is possibl CVE-2021-23353.5Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are af CVE-2021-233514.9The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The read CVE-2021-233529.8This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which wh CVE-2021-233537.5This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.CVE-2021-233547.5The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-CVE-2021-233559.8This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function, it is possible for an attac