CVE-2020-26297: 
Rust vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in mdBook, a utility for creating online books from Markdown files written in Rust. The vulnerability (CVE-2020-26297) affected versions from 0.1.4 to versions before 0.4.5, specifically impacting the search feature introduced in version 0.1.4. The issue was discovered on December 30, 2020, and was patched with the release of version 0.4.5 on January 4, 2021 (GitHub Advisory, Rust Blog).

The vulnerability allowed an attacker to execute arbitrary JavaScript code on a user's browser through the search feature. The issue stemmed from improper escaping of search queries in the search page. The fix implemented in version 0.4.5 properly escapes the search query by using encodeURIComponent and manually replacing single quotes with their URL-encoded representation (GitHub Commit). The vulnerability received a CVSS v3.1 Base Score of 8.2 (HIGH) from GitHub and 6.1 (MEDIUM) from NVD (NVD).

An attacker could exploit this vulnerability by either tricking users into typing malicious search queries or by having them click on links to the search page with malicious search queries prefilled. This would allow the attacker to execute arbitrary JavaScript code in the context of the user's browser, potentially leading to theft of sensitive information or other malicious actions (GitHub Advisory).

The vulnerability required user interaction to be exploited, either through entering a malicious search query or clicking a specially crafted link. No evidence of active exploitation in the wild was reported before the patch was released (Rust Blog).

The vulnerability was fixed in mdBook version 0.4.5. Website owners using mdBook must upgrade to version 0.4.5 or greater and rebuild their website contents. The upgrade can be performed using the command: cargo install mdbook --version 0.4.5 --force (GitHub Advisory).