CVE-2017-20239

CVE-2017-20239 is a cross-site scripting (XSS) vulnerability in MDwiki that enables remote attackers to execute arbitrary JavaScript code by injecting malicious payloads through the location hash parameter. The vulnerability exists because MDwiki parses and renders hash fragments without proper sanitization, allowing attackers to craft URLs containing JavaScript code that will execute within a victim's browser context. The vulnerability has a CVSS v3.1 score of 6.1 (MEDIUM), with a network-based attack vector requiring no privileges but necessitating user interaction. The attack has low complexity and moderate impact, potentially compromising confidentiality and integrity while maintaining service availability. The extremely low EPSS score of 0.0001 indicates minimal real-world exploitation probability compared to other known vulnerabilities. There is no indication of active exploitation in the wild, as the vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on public hot lists. While this vulnerability warrants patching to reduce the attack surface, its low exploitation likelihood and moderate risk profile suggest it is not currently a priority for incident response teams.