Arch Linux Security Advisory ASA-202101-8
========================================
Severity: Medium
Date    : 2021-01-12
CVE-ID  : CVE-2020-26297
Package : mdbook
Type    : cross-site scripting
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1399

Summary
======
The package mdbook before version 0.4.5-1 is vulnerable to cross-site
scripting.

Resolution
=========
Upgrade to 0.4.5-1.

# pacman -Syu "mdbook>=0.4.5-1"

The problem has been fixed upstream in version 0.4.5.

Workaround
=========
None.

Description
==========
The search feature of mdBook (introduced in version 0.1.4) was affected
by a cross site scripting vulnerability that allowed an attacker to
execute arbitrary JavaScript code on an user's browser by tricking the
user into typing a malicious search query, or tricking the user into
clicking a link to the search page with the malicious search query
prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping
the search query.

Impact
=====
A malicious user can execute arbitrary code in a user's browser with a
malicious search query.

References
=========
https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0
https://github.com/rust-lang/mdBook/commit/648c9ae772bec83f0a5954d17b4287d5bb1d6606
https://security.archlinux.org/CVE-2020-26297