GHSA-98pf-gfh3-x3mp
Read the Docs vulnerable to Cross-Site Scripting (XSS)
Impact
This vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project.
Exploiting this would have required the attacker to get a logged-in user to visit the malicious URL, which would have allowed the attacker to take control of the user's session with JavaScript (making requests to the API/site on behalf of the user). This URL would have looked something like hxxps[:]//readthedocs[.]org/projects/attacker-project/downloads/html/version-with-javascript-attack/.
Patches
This issue has been patched in our 8.8.1 release.
What each source reports
GitHub AdvisoriesNo score
Read the Docs vulnerable to Cross-Site Scripting (XSS)
Impact
This vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project.
Exploiting this would have required the attacker to get a logged-in user to visit the malicious URL, which would have allowed the attacker to take control of the user's session with JavaScript (making requests to the API/site on behalf of the user). This URL would have looked something like hxxps[:]//readthedocs[.]org/projects/attacker-project/downloads/html/version-with-javascript-attack/.
Patches
This issue has been patched in our 8.8.1 release.
- Record
GHSA-98pf-gfh3-x3mp- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Read the Docs vulnerable to Cross-Site Scripting (XSS)
Impact
This vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project.
Exploiting this would have required the attacker to get a logged-in user to visit the malicious URL, which would have allowed the attacker to take control of the user's session with JavaScript (making requests to the API/site on behalf of the user). This URL would have looked something like hxxps[:]//readthedocs[.]org/projects/attacker-project/downloads/html/version-with-javascript-attack/.
Patches
This issue has been patched in our 8.8.1 release.
- Record
GHSA-98pf-gfh3-x3mp- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
readthedocsnpm | before 8.8.1 | 8.8.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-98pf-gfh3-x3mp is a vulnerability with no CVSS score yet in readthedocs, published November 10, 2022. No source lists public exploit code. Fixed in readthedocs 8.8.1.