CVE-2020-7680

docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.

• CWE-79

• http://packetstormsecurity.com/files/158515/Docsify.js-4.11.4-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/Feb/71Mailing List, Third Party Advisory
• https://github.com/docsifyjs/docsify/issues/1126Third Party Advisory
• https://github.com/docsifyjs/docsify/pull/1128Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-DOCSIFY-567099Third Party Advisory
• http://packetstormsecurity.com/files/158515/Docsify.js-4.11.4-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/Feb/71Mailing List, Third Party Advisory
• https://github.com/docsifyjs/docsify/issues/1126Third Party Advisory
• https://github.com/docsifyjs/docsify/pull/1128Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-DOCSIFY-567099Third Party Advisory

Published

Jul 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7674access-policy through 3.1.0 is vulnerable to Arbitrary Code …9.8
• CVE-2020-7675cd-messenger through 2.7.26 is vulnerable to Arbitrary Code …9.8
• CVE-2020-7676angular.js prior to 1.8.0 allows cross site scripting. The r…5.4
• CVE-2020-7677This affects the package thenify before 3.3.1. The name argu…9.8
• CVE-2020-7678This affects all versions of package node-import. The "param…9.8
• CVE-2020-7679In all versions of package casperjs, the mergeObjects utilit…9.8
• CVE-2020-7681This affects all versions of package marscode. There is no p…7.5
• CVE-2020-7682This affects all versions of package marked-tree. There is n…7.5
• CVE-2020-7683This affects all versions of package rollup-plugin-server. T…7.5
• CVE-2020-7684This affects all versions of package rollup-plugin-serve. Th…9.8
• CVE-2020-7685This affects all versions of package UmbracoForms. When usin…7.5
• CVE-2020-7686This affects all versions of package rollup-plugin-dev-serve…7.5