This is a cross-post of the official security advisory. The official post contains a signed version with our PGP key, as well.
The CVE for this vulnerability is CVE-2020-26297.
mdBook 0.4.5 fixes the vulnerability by properly escaping the search query.
Owners of websites built with mdBook have to upgrade to mdBook 0.4.5 or greater and rebuild their website contents with it. It's possible to install mdBook 0.4.5 on the local system with:
cargo install mdbook --version 0.4.5 --force
Thanks to Kamil Vavra for responsibly disclosing the vulnerability to us according to our security policy.
Timeline of events
All times are listed in UTC.
- 2020-12-30 20:14 - The issue is reported to the Rust Security Response WG
- 2020-12-30 20:32 - The issue is acknowledged and the investigation began
- 2020-12-30 21:21 - Found the cause of the vulnerability and prepared the patch
- 2021-01-04 15:00 - Patched version released and vulnerability disclosed