CVE-2020-26298: 
Ruby vulnerability analysis and mitigation

Redcarpet, a Ruby library for Markdown processing, was found to contain an injection vulnerability (CVE-2020-26298) before version 3.5.1. The vulnerability was discovered and reported by Johan Smits, and the issue was disclosed on January 11, 2021. The vulnerability affects all versions of Redcarpet prior to 3.5.1, impacting systems using the library for Markdown to HTML conversion (GitHub Advisory).

The vulnerability stems from improper HTML escaping when processing quotes, even when the :escape_html option was enabled. This security flaw could enable cross-site scripting (XSS) attacks. The issue has been assigned a CVSS v3.1 base score of 6.8 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N (NVD).

The vulnerability could allow attackers to execute cross-site scripting (XSS) attacks through specially crafted input, potentially leading to the injection of malicious code into web applications using the Redcarpet library. This could result in unauthorized data manipulation or execution of arbitrary code in the context of the affected web application (GitHub Advisory).

The vulnerability requires an attacker to have the ability to input markdown content that is processed by the Redcarpet library. The attack vector is network-accessible and requires low attack complexity, though it does need user interaction and low privileges to execute (NVD).

The vulnerability has been fixed in Redcarpet version 3.5.1. Users are strongly advised to upgrade to this version or later. The fix involves proper HTML escaping when processing quotes with the :escape_html option enabled (Redcarpet Changelog, GitHub Patch).

Multiple Linux distributions have released security advisories and patches for this vulnerability, including Debian with DSA-4831-1 and DLA-2526-1, and Fedora with updates for versions 36, 37, and 38 (Debian Security, Fedora Update).