CVE-2020-26298: Injection in Redcarpet
Vulnerability summary
CVE-2020-26298 is a medium (CVSS 6.8) vulnerability in debian debian_linux. EPSS estimates a 1.59% chance of exploitation in the next 30 days, higher than 75.6% of scored vulnerabilities.
Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 11-01-2021PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · RubygemsEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.59%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
Increase +0.02 pp
From 1.57% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
- CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- ruby-redcarpet< 3.4.0-4+deb10u1 | < 3.3.4-2+deb9u1 | < 3.5.1-1
- debian_linuxEOL9.0 | 10.0
Redcarpet_project1 product
- redcarpet< 3.5.1
RubyGems1 product
- redcarpet< 3.5.1
Vmg1 product
- redcarpet< 3.5.1
4 vendors · 5 products
References
16 links- github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793WEBPatchThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
