CVE-2020-26287

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but `www.google-analytics.com` is allowed. Using Google Tag Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.1. As a workaround one can disallow `www.google-analytics.com` in the `Content-Security-Policy` header. Note that other ways to leverage the `script` tag injection might exist.

• CWE-79
• CWE-79

• https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.mdExploit, Third Party Advisory
• https://github.com/hackmdio/codimd/issues/1630Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc1069d4Patch, Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95pThird Party Advisory
• https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.mdExploit, Third Party Advisory
• https://github.com/hackmdio/codimd/issues/1630Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc1069d4Patch, Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95pThird Party Advisory

Published

Dec 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26281async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates…7.5
• CVE-2020-26282BrowserUp Proxy allows you to manipulate HTTP requests and r…10
• CVE-2020-26283go-ipfs is an open-source golang implementation of IPFS whic…8.8
• CVE-2020-26284Hugo is a fast and Flexible Static Site Generator built in G…8.5
• CVE-2020-26285OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26286HedgeDoc is a collaborative platform for writing and sharing…7.5
• CVE-2020-26288Parse Server is an open source backend that can be deployed …6.5
• CVE-2020-26289date-and-time is an npm package for manipulating date and ti…7.5
• CVE-2020-2629Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26290Dex is a federated OpenID Connect provider written in Go. In…9.6
• CVE-2020-26291URI.js is a javascript URL mutation library (npm package uri…6.5
• CVE-2020-26292Creeper is an experimental dynamic, interpreted language. Th…9.8