漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering
Vulnerability Description
Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0.
CVSS Information
N/A
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
Docmost 安全漏洞
Vulnerability Description
Docmost是Docmost开源的一个开协作维基和文档软件。 Docmost 0.23.2及之前版本存在安全漏洞，该漏洞源于Mermaid代码块渲染未进行清理，可能导致存储型跨站脚本攻击。
CVSS Information
N/A
Vulnerability Type
N/A