Description
govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | govuk_tech_docs | 2.0.2 – < 3.3.1 | 3.3.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | govuk_tech_docs | >= 2.0.2, < 3.3.1 | 3.3.1 | GHSA-x2xw-hw8g-6773 |
References
- GitHub Security Advisory (GHSA-x2xw-hw8g-6773) vendor-advisory
- https://github.com/alphagov/tech-docs-gem/pull/323 issue-tracking patch
- tech-docs-gem 3.3.1 Release Notes related release-notes
- GitHub Security Advisory (GHSA-x2xw-hw8g-6773) vendor-advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773 third-party-advisory