Vulnerability record · CVE-2020-4052 · published 16 June 2020

CVE-2020-4052: Requarks wiki.js cross-site scripting vulnerability

Requarks · Wiki.Js

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. This has been patched in 2.4.107.

6.1 CVSS 3.1 Medium EPSS 0.84% · top 44.0% CWE-79 · Cross-site scripting

6.1CVSS 3.1 base score, v2 4.3

0.84%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Wiki.Js Requarks

References

Link	Tags
https://github.com/Requarks/wiki/commit/9e08718ee904046f8b2294ef6ac79e8a75a451e3	PatchThird Party Advisory
https://github.com/Requarks/wiki/security/advisories/GHSA-9jgg-4xj2-vjjj	Third Party Advisory
https://github.com/Requarks/wiki/commit/9e08718ee904046f8b2294ef6ac79e8a75a451e3	PatchThird Party Advisory
https://github.com/Requarks/wiki/security/advisories/GHSA-9jgg-4xj2-vjjj	Third Party Advisory

Track CVE-2020-4052 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2025-56643Requarks wiki.js insufficient session expiration vulnerabilityRequarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain …EPSS 0.36%18 Nov 2025 8.6CVE-2026-44224Requarks wiki.js improper privilege management vulnerabilityWiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applie…EPSS 0.56%12 May 2026 7.5CVE-2021-43800Requarks wiki.js path traversal vulnerabilityWiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module wi…EPSS 1.7%6 Dec 2021 7.5CVE-2020-15236Requarks wiki.js path traversal vulnerabilityIn Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching i…EPSS 1.8%5 Oct 2020 7.2CVE-2022-1681Requarks wiki.js authentication bypass via alternate path vulnerabilityAuthentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissionsEPSS 1.9%12 May 2022 6.5CVE-2022-23654Requarks wiki.js improper authentication vulnerabilityWiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page o…EPSS 0.72%22 Feb 2022 5.4CVE-2021-25993Requarks wiki.js cross-site scripting vulnerabilityIn Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a S…EPSS 0.62%29 Dec 2021 5.4CVE-2021-43855Requarks wiki.js cross-site scripting vulnerabilityWiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a…EPSS 0.89%27 Dec 2021

Source: NIST National Vulnerability Database (record CVE-2020-4052), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.