Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2020-4052

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. This has been patched in 2.4.107.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2020-4052
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:28 UTC · Revision 1

Source evidence

CVE-2020-4052

core-osv · Original source

Published 16 Jun 2020, 22:15 UTC

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. This has been patched in 2.4.107.

osv:CVE-2020-4052
Complete source record
{
  "id": "8e9b12ac5459e9866ef103da717e438a47da87928dfae9c3165fb20c7a6193cf",
  "url": "https://osv.dev/vulnerability/CVE-2020-4052",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2020-4052",
    "summary": "In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. This has been patched in 2.4.107.",
    "evidence": "osv:CVE-2020-4052",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2020-4052",
      "aliases": [
        "CVE-2020-4052",
        "GHSA-9jgg-4xj2-vjjj"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/requarks/wiki",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "9e08718ee904046f8b2294ef6ac79e8a75a451e3"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:requarks:wiki.js:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.4.107"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "9e08718ee904046f8b2294ef6ac79e8a75a451e3"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "2.4.105",
            "2.4.75",
            "2.3.77",
            "2.3.72",
            "2.3.71",
            "2.2.51",
            "2.2.50",
            "2.1.113",
            "2.0.12",
            "2.0.1",
            "2.0.0-rc.17",
            "2.0.0-rc.1",
            "2.0.0-beta.303",
            "2.0.0-beta.275",
            "2.0.0-beta.268",
            "2.0.0-beta.267",
            "2.0.0-beta.241",
            "2.0.0-beta.230",
            "2.0.0-beta.208",
            "2.0.0-beta.203",
            "2.0.0-beta.180",
            "2.0.0-beta.174",
            "2.0.0-beta.148",
            "2.0.0-beta.147",
            "2.0.0-beta.115",
            "2.0.0-beta.91",
            "2.0.0-beta.84",
            "2.0.0-beta.68",
            "2.0.0-beta.42",
            "2.0.0-beta.11",
            "v1.0.6",
            "v1.0.5",
            "v1.0.4",
            "v1.0.3",
            "v1.0.0-beta.13",
            "v1.0.0-beta.12",
            "v1.0.0-beta.11",
            "v1.0.0-beta.10",
            "v1.0.0-beta.9",
            "v1.0.0-beta.8",
            "v1.0.0-beta.7",
            "v1.0.0-beta.6",
            "v1.0-beta.5",
            "v1.0-beta.4",
            "v1.0-beta.3",
            "v1.0-beta.2",
            "v1.0-beta.1",
            "v1.0-alpha.7",
            "v1.0-alpha.6",
            "v1.0-alpha.5",
            "v1.0-alpha.4",
            "v1.0-alpha.3",
            "v1.0-alpha.2",
            "v1.0-alpha.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-4052.json"
          }
        }
      ],
      "modified": "2026-10-20T10:54:21.882659355Z",
      "provider": "osv",
      "references": [
        "https://github.com/Requarks/wiki/security/advisories/GHSA-9jgg-4xj2-vjjj",
        "https://github.com/Requarks/wiki/commit/9e08718ee904046f8b2294ef6ac79e8a75a451e3"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2020-4052",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 385193,
  "published_at": "2020-06-16T22:15:10.503+00:00"
}