https://github.com/hackmdio/codimd/issues/1648

https://github.com/hedgedoc/hedgedoc/commit/35b0d39a12aa35f27fba8c1f50b1886706e7efef

https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2

https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw

NIST AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NIST AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

https://github.com/hackmdio/codimd/issues/1648 No Types Assigned

https://github.com/hackmdio/codimd/issues/1648 Exploit, Patch, Third Party Advisory

HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. ### Workarounds Disallow loading JavaScript from 3rd party sites using the `Content-Security

HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. As a workaround, disallow loading JavaScript from 3rd party sites using the `Content-Securit

https://github.com/hackmdio/codimd/issues/1648 [No Types Assigned]

NIST AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

NIST (AV:N/AC:M/Au:N/C:N/I:P/A:N)

OR
     *cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:* versions up to (excluding) 1.7.2

https://github.com/hedgedoc/hedgedoc/commit/35b0d39a12aa35f27fba8c1f50b1886706e7efef No Types Assigned

https://github.com/hedgedoc/hedgedoc/commit/35b0d39a12aa35f27fba8c1f50b1886706e7efef Patch, Third Party Advisory

https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 No Types Assigned

https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 Release Notes, Third Party Advisory

https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw No Types Assigned

https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw Third Party Advisory

Victim must voluntarily interact with attack mechanism

HedgeDoc is open source software which lets you create real-time collaborative markdown notes.  In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode.

Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes.

The problem is patched in HedgeDoc 1.7.2.

### Workarounds
Disallow loading JavaScript from 3rd party sites using the `Content-Secu

HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. ### Workarounds Disallow loading JavaScript from 3rd party sites using the `Content-Security