Wiki.js Stored Cross-Site Scripting Vulnerability in Code Blocks

A stored cross-site scripting vulnerability has been identified in Wiki.js versions prior to 2.5.190. This issue arises from mustache expressions in code blocks being processed by Vue during content injection, despite being enclosed within `<pre>` elements. A malicious user can exploit this vulnerability by crafting a wiki page that executes harmful JavaScript when viewed by others.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, create a wiki page in a version of Wiki.js prior to 2.5.190. Insert a mustache expression into a code block, such as one that triggers a JavaScript alert. When the page is saved and viewed, the JavaScript will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users can upgrade to Wiki.js version 2.5.190 or later, where this vulnerability has been patched.