{"id":"CVE-2024-34710","aliases":["EUVD-2024-35000","GHSA-xjcj-p2qv-q3rf","GO-2024-2875"],"status":"published","title":"Wiki.js Stored XSS through Client Side Template Injection","description":"Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00395,"percentile":0.34189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1336"],"published":"2024-05-20T21:59:16Z","modified":"2026-10-28T02:30:55Z","affected":[{"source":"osv","ecosystem":"Go","package":"github.com/requarks/wiki","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"requarks","product":"wiki"},{"vendor":"requarks","product":"wiki.js"}],"references":[{"url":"https://github.com/requarks/wiki/security/advisories/GHSA-xjcj-p2qv-q3rf","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/requarks/wiki/commit/1238d614e1599fefadd4614ee4b5797a087f50ac","tags":["x_refsource_MISC","x_transferred","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34710.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34710","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-34710","title":"Wiki.js Stored XSS through Client Side Template Injection ","description":"Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.\n","status":"published","published":"2024-05-20T21:59:16.606Z","modified":"2024-08-02T02:59:22.635Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:34:23.193864Z"}],"euvd":[{"id":"EUVD-2024-35000","description":"Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.\n","status":"published","published":"2024-05-20T21:59:16Z","modified":"2024-08-02T02:59:22Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T03:50:20.898281Z"}],"nvd":[{"id":"CVE-2024-34710","description":"Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.\n","status":"published","published":"2024-05-20T22:15:08.5Z","modified":"2026-06-17T07:33:55.317Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:10:01.327642Z"}],"osv":[{"id":"CVE-2024-34710","title":"Wiki.js Stored XSS through Client Side Template Injection ","description":"Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.\n","status":"published","published":"2024-05-20T21:59:16.606Z","modified":"2026-10-28T02:30:55.06943574Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"GO-2024-2875","title":"Wiki.js Stored XSS through Client Side Template Injection in github.com/requarks/wiki","description":"Wiki.js Stored XSS through Client Side Template Injection in github.com/requarks/wiki","status":"published","published":"2024-06-05T15:10:52Z","modified":"2026-03-03T04:55:24.13392Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}