Security readout for executives and security teams
Plain-English summary
Older GitBook versions could store unsafe script-like content in a book and run it when someone viewed the online reader. This is a stored XSS risk: it can affect readers of generated documentation, especially where outside contributors can influence book content.
Executive priority
Treat this as a moderate documentation-platform risk. Prioritize remediation if public docs, customer portals, or internal authenticated readers were built with vulnerable GitBook versions and accept contributed content.
Technical view
CVE-2017-16019 is CWE-79 stored XSS in the GitBook Node module before 3.2.2. The source says code outside backticks in an ebook could execute in the online reader. No CVSS score or detailed impact boundaries are provided in the bundle.
Likely exposure
Exposure is most likely where GitBook before 3.2.2 builds or serves books from Markdown or AsciiDoc content, especially with user, contractor, community, or automated content inputs. Trusted internal-only publishing lowers likelihood but does not remove risk.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation evidence. Exploitation depends on malicious content being included in an ebook and a reader opening it in the online reader context.
Researcher notes
The public bundle is sparse: it identifies stored XSS, affected versions before 3.2.2, and execution in the online reader, but lacks CVSS, exploit prevalence, payload mechanics, and environmental prerequisites beyond ebook content handling.
Mitigation direction
- Upgrade the gitbook Node module to version 3.2.2 or later.
- Check vendor guidance and the linked issue for historical remediation details.
- Restrict who can contribute or publish GitBook source content.
- Review generated books for unsafe embedded script content.
- Avoid serving vulnerable generated readers to authenticated users.
Validation and detection
- Inventory projects depending on the gitbook Node module.
- Confirm no deployed or build-time version is earlier than 3.2.2.
- Identify books built from external or semi-trusted contributions.
- Review publishing pipelines that automatically render Markdown or AsciiDoc.
- Check whether vulnerable online readers remain publicly accessible.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2017-16019 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://nodesecurity.io/advisories/159CVE reference · x_refsource_MISC
- https://github.com/GitbookIO/gitbook/issues/1609CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.