CVE-2025-46654

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-46654
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46654.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-46654
Published
2025-04-26T21:15:15Z
Modified
2025-04-29T16:49:39.171447Z
Summary
[none]
Details

CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file.

References

Affected packages

Git / github.com/hackmdio/codimd

Affected ranges

Type
GIT
Repo
https://github.com/hackmdio/codimd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3e7544576b2d5d26efe8dfa40cdb9f1116ebaa78

Affected versions

0.*

0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.5.0

1.*

1.0.0-ce
1.0.1-ce
1.1.0-ce
1.1.1-ce
1.2.0
1.2.1
1.3.0
1.3.1
1.4.0
1.4.0-rc.1
1.4.0-rc.2
1.4.1
1.4.1-rc.1

2.*

2.0.0
2.0.0-rc.1
2.0.1
2.0.1-rc.1
2.1.0
2.2.0

v0.*

v0.3.3
v0.3.4