CVE-2020-35660: 
NixOS vulnerability analysis and mitigation

Cross Site Scripting (XSS) vulnerability was discovered in Monica before version 2.19.1, specifically affecting the journal page functionality. The vulnerability was disclosed and patched in September 2020 (Monica Release, Monica Pull Request).

The vulnerability was related to PHP Parsedown usage in the journal entry functionality. The fix involved removing PHP Parsedown and implementing markdown parsing using JavaScript's marked module to prevent XSS attacks. The change was implemented through a pull request that modified how journal entries are processed (Monica Pull Request).

The vulnerability allowed for Cross Site Scripting (XSS) attacks through the journal page, potentially enabling attackers to inject malicious scripts into the application. This could lead to unauthorized access to user data or execution of unauthorized actions in the context of the user's session.

The vulnerability was exploitable through the journal page functionality, requiring access to the journal entry feature. The issue was addressed and fixed in version 2.19.1 of the application (Monica Release).

The vulnerability was fixed in Monica version 2.19.1. Users should upgrade to this version or later to protect against this vulnerability. The fix involved changing the markdown parsing implementation from PHP Parsedown to JavaScript's marked module (Monica Release).