Docmost JavaScript URI Injection Vulnerability in Comments Allowing Cross-Site Scripting

A cross-site scripting vulnerability has been identified in Docmost versions prior to 0.80.0. When users leave comments on a page, they can include links with JavaScript URIs. If another user clicks on such a link, the JavaScript code executes, potentially leading to malicious actions.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Docmost version 0.80.0 or later to address this vulnerability.