CVE-2017-16019

GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.

• CWE-79
• CWE-79

• https://github.com/GitbookIO/gitbook/issues/1609Exploit, Third Party Advisory
• https://nodesecurity.io/advisories/159Third Party Advisory
• https://github.com/GitbookIO/gitbook/issues/1609Exploit, Third Party Advisory
• https://nodesecurity.io/advisories/159Third Party Advisory

Published

Jun 4, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16013hapi is a web and services application framework. When hapi …
• CVE-2017-16014Http-proxy is a proxying library. Because of the way errors …7.5
• CVE-2017-16015Forms is a library for easily creating HTML forms. Versions …
• CVE-2017-16016Sanitize-html is a library for scrubbing html input of malic…
• CVE-2017-16017sanitize-html is a library for scrubbing html input for mali…
• CVE-2017-16018Restify is a framework for building REST APIs. Restify >=2.0…
• CVE-2017-1602IBM RSA DM (IBM Rational Collaborative Lifecycle Management …4.3
• CVE-2017-16020Summit is a node web framework. When using the PouchDB drive…9.8
• CVE-2017-16021uri-js is a module that tries to fully implement RFC 3986. O…6.5
• CVE-2017-16022Morris.js creates an svg graph, with labels that appear when…
• CVE-2017-16023Decamelize is used to convert a dash/dot/underscore/space se…
• CVE-2017-16024The sync-exec module is used to simulate child_process.execS…