GHSA-mpjf-8cmf-p789
Cross-Site Scripting in jingo
Versions of jingo prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as <script>alert(1)</script> is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.
Recommendation
Upgrade to version 1.9.2
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in jingo
Versions of jingo prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as <script>alert(1)</script> is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.
Recommendation
Upgrade to version 1.9.2
- Record
GHSA-mpjf-8cmf-p789- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in jingo
Versions of jingo prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as <script>alert(1)</script> is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.
Recommendation
Upgrade to version 1.9.2
- Record
GHSA-mpjf-8cmf-p789- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jingonpm | before 1.9.2 | 1.9.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-mpjf-8cmf-p789 is a vulnerability with no CVSS score yet in jingo, published September 1, 2020. No source lists public exploit code. Fixed in jingo 1.9.2.