CVE-2018-20583

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-20583
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20583.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-20583
Aliases
Published
2018-12-30T05:29:00.753Z
Modified
2026-07-08T19:45:20.174450Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allowunsafelinks is false) via a newline character (e.g., writing javascript as javascri%0apt).

References

Affected packages

Git / github.com/thephpleague/commonmark

Affected ranges

Type
GIT
Repo
https://github.com/thephpleague/commonmark
Events
Introduced
91742543c25fecedc84a4883d2919213e04a73b7
Last affected
006af077d4b1b7eb1d9760964f9f984ba188632c
Fixed
e5029f74ba39e043ce4b3ca6c05dc719d8aafd94
Database specific 
{
    "cpe": "cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.15.6"
        },
        {
            "last_affected": "0.18.0"
        }
    ]
}

Affected versions

0.*
0.15.6
0.15.7
0.16.0
0.17.0
0.17.2
0.17.4
0.18.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20583.json"