GHSA-2h8j-8r9p-849f

Suggest an improvement
Source
https://github.com/advisories/GHSA-2h8j-8r9p-849f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-2h8j-8r9p-849f/GHSA-2h8j-8r9p-849f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2h8j-8r9p-849f
Aliases
Published
2025-09-19T06:31:21Z
Modified
2025-09-22T22:55:37Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
@digitalocean/do-markdownit has Type Confusion vulnerability
Details

Overview

A type confusion issue exists in the @digitalocean/do-markdownit package. In the callout and fence_environment plugins, the allowedClasses and allowedEnvironments options are expected to be arrays of strings. If these options are provided as a single string, the code applies .includes directly on the string, resulting in substring matching instead of membership checks against an array.

Affected Versions

All versions up to and including 1.16.1 (npm).

Impact

Supplying crafted input can bypass intended allow-lists (e.g., class/environment constraints) due to substring checks, which may enable rendering of unintended classes or environments and lead to policy bypass in downstream consumers.

Mitigation

Until an upstream fix is released, ensure configuration normalization before invoking the plugins:

  • Validate that allowedClasses and allowedEnvironments are arrays (Array.isArray(...)), converting single strings into one-element arrays when necessary.
  • Consider sanitizing or strictly validating user-controlled values that influence Markdown rendering.
Database specific 
{
    "cwe_ids":  [
        "CWE-843"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-09-19T17:15:44Z",
    "nvd_published_at":  "2025-09-19T04:16:49Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / @digitalocean/do-markdownit

Package

Name
@digitalocean/do-markdownit
View open source insights on deps.dev
Purl
pkg:npm/%40digitalocean/do-markdownit

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
1.16.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-2h8j-8r9p-849f/GHSA-2h8j-8r9p-849f.json"