Docusaurus

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime XSS 45 % Injection 20 % Parsing/validation 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Docusaurus is the static documentation site generator behind a large fraction of open-source project documentation, including much of the CNCF and Meta's own. Its install count is very high and its risk-weighted value is low, and both halves of that sentence matter: it is everywhere, but it emits static sites, so the findings that show up are client-side rather than server-side; stored XSS through Markdown and MDX handling, or prototype pollution during the build. That is what the recorded bug distribution says too, with XSS at 45% and injection and parsing sharing most of the rest. Be clear-eyed about the money before you commit weeks here. Meta pays cash for a report with a published minimum of $500, determines severity itself, and publishes no payout guideline covering open source; the $150,000 ceiling attached to Meta elsewhere derives from its mobile remote-code-execution guideline and no static site generator can reach it. Realistic outcomes start at the floor. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/docusaurus sits under the first, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source The Markdown and MDX pipeline end to end: front matter, remark and rehype plugins, admonitions, code blocks and the HTML that content compiles into The packages the project publishes under @docusaurus/ : core, the classic preset, the theme packages, and the official plugins for docs, blog, pages, sitemap, search and client redirects The build pipeline: configuration loading, plugin and preset resolution, the webpack and static-generation steps, and the output they emit The client runtime that ships to readers, covering the router, link and history handling, the search UI and the theme components Versioning, internationalisation and translation loading, where content and metadata are read off disk and merged The CLI and its start , build , serve , swizzle , deploy and write-translations commands, the dev server included Out of scope Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on Duplicates. Meta pays the first reporter only Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions Self-XSS, and anything that needs the site owner to author hostile documentation. Whoever writes the docs already controls what the build emits Defects in a third-party theme or plugin, or in a downstream site's own content, rather than in Docusaurus itself Server-side attack scenarios asserted rather than demonstrated. Docusaurus emits a static site, so a server-side claim has to show how the code runs at request time at all Most-valued findings Stored XSS that survives the Markdown or MDX pipeline into the published site, executing for every reader of a documentation page. XSS is 45% of the expected distribution and the only class with a large installed base behind it Prototype pollution during the build that changes what the generated site contains, converting a configuration or content file into control over the output Injection into generated JavaScript or into a process the build invokes, which turns documentation content into code on whoever's machine or CI runner does the build MDX component resolution flaws that let content reach a React component or a raw HTML path it was never meant to reach Any of the above on a site straight out of create-docusaurus with the classic preset, since a finding needing an unusual plugin configuration will not survive Meta's impact scoring Size the effort honestly before you start. There is no CVE record here and none on the @docusaurus/core npm package either, and realistic outcomes for a static site generator start at the $500 floor Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source, and Meta publishes no XSS-specific guideline that would apply here Do not size your effort against the $150,000 figure: it comes from the mobile remote-code-execution guideline, which requires a proof of concept on a recent Android or a currently supported iOS version, so it is inapplicable to a build tool Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so demonstrate the defect on a default Docusaurus site rather than on a configuration you had to weaken Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Because that clause reaches private transfer as well as publication, file with Meta directly first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability