← All advisories

Medium severity6.1NVD Advisory· Published Jul 15, 2022· Updated Jul 9, 2026

CVE-2020-35305

CVE-2020-35305

Description

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
gollumRubyGems	>= 5.0, < 5.1.2	5.1.2

Affected products

3

Gollum Project/Gollum
cpe:2.3:a:gollum_project:gollum:*:*:*:*:*:*:*:*
Range: >=5.0.0,<=5.1.2
gollum/gollumdescription
ghsa-coords
pkg:gem/gollum
Range: >= 5.0, < 5.1.2

Patches

Vulnerability mechanics

References

6

github.com/advisories/GHSA-fj2w-qmjp-3rjmghsaADVISORY
github.com/gollum/gollum/releases/tag/v5.1.2nvdRelease NotesThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-35305ghsaADVISORY
gollum.comghsaWEB
github.com/gollum/gollum/commit/137728cdabc0f60859fcd30404ad2b8fff6ef715ghsaWEB
github.com/rubysec/ruby-advisory-db/blob/master/gems/gollum/CVE-2020-35305.ymlghsaWEB

News mentions

0

No linked articles in our index yet.