{"id":"GHSA-98pf-gfh3-x3mp","aliases":[],"status":"published","title":"Read the Docs vulnerable to Cross-Site Scripting (XSS)","description":"### Impact\n\nThis vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project. \n\nExploiting this would have required the attacker to get a logged-in user to visit the malicious URL, which would have allowed the attacker to take control of the user's session with JavaScript (making requests to the API/site on behalf of the user). This URL would have looked something like `hxxps[:]//readthedocs[.]org/projects/attacker-project/downloads/html/version-with-javascript-attack/`.\n\n### Patches\n\nThis issue has been patched in our 8.8.1 release.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-11-10T16:02:51Z","modified":"2023-01-07T05:06:04Z","fixes":[{"ecosystem":"npm","package":"readthedocs","fixed_in":["8.8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"readthedocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.1"}]}]},{"source":"osv","ecosystem":"npm","package":"readthedocs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.8.1"}]}]}],"references":[{"url":"https://github.com/readthedocs/readthedocs.org/security/advisories/GHSA-98pf-gfh3-x3mp","tags":["web"]},{"url":"https://github.com/readthedocs/readthedocs.org/commit/b0ae626acd13882170ec5888e35f3ef2e48e6ff6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-98pf-gfh3-x3mp"},{"url":"https://github.com/readthedocs/readthedocs.org","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-98pf-gfh3-x3mp","title":"Read the Docs vulnerable to Cross-Site Scripting (XSS)","description":"### Impact\n\nThis vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project. \n\nExploiting this would have required the attacker to get a logged-in user to visit the malicious URL, which would have allowed the attacker to take control of the user's session with JavaScript (making requests to the API/site on behalf of the user). This URL would have looked something like `hxxps[:]//readthedocs[.]org/projects/attacker-project/downloads/html/version-with-javascript-attack/`.\n\n### Patches\n\nThis issue has been patched in our 8.8.1 release.","status":"published","published":"2022-11-10T16:02:51Z","modified":"2023-01-07T05:06:04Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-98pf-gfh3-x3mp","title":"Read the Docs vulnerable to Cross-Site Scripting (XSS)","description":"### Impact\n\nThis vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project. \n\nExploiting this would have required the attacker to get a logged-in user to visit the malicious URL, which would have allowed the attacker to take control of the user's session with JavaScript (making requests to the API/site on behalf of the user). This URL would have looked something like `hxxps[:]//readthedocs[.]org/projects/attacker-project/downloads/html/version-with-javascript-attack/`.\n\n### Patches\n\nThis issue has been patched in our 8.8.1 release.","status":"published","published":"2022-11-10T16:02:51Z","modified":"2022-11-10T16:02:51Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.524801Z"}]}}