GHSA-2h8j-8r9p-849f
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2h8j-8r9p-849f
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-2h8j-8r9p-849f/GHSA-2h8j-8r9p-849f.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2h8j-8r9p-849f
- Aliases
- Published
- 2025-09-19T06:31:21Z
- Modified
- 2025-09-19T17:44:33.224857Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- @digitalocean/do-markdownit has Type Confusion vulnerability
- Details
-
In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array).
- Database specific
{ "nvd_published_at": "2025-09-19T04:16:49Z", "severity": "MODERATE", "cwe_ids": [ "CWE-843" ], "github_reviewed": true, "github_reviewed_at": "2025-09-19T17:15:44Z" }- References
Affected packages
npm / @digitalocean/do-markdownit
Package
- Name
- @digitalocean/do-markdownit
- View open source insights on deps.dev
- Purl
- pkg:npm/%40digitalocean/do-markdownit