GHSA-36m4-6v6m-4vpr

Source

https://github.com/advisories/GHSA-36m4-6v6m-4vpr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-36m4-6v6m-4vpr/GHSA-36m4-6v6m-4vpr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-36m4-6v6m-4vpr

Aliases

CVE-2019-12043

Published

2019-05-29T18:04:55Z

Modified

2023-11-08T04:01:02Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-site Scripting in remarkable

Details

In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-05-14T01:14:15Z",
    "nvd_published_at": "2019-05-13T14:29:00Z",
    "severity": "MODERATE"
}

References

Affected packages

npm / remarkable

Package

Name: remarkable; View open source insights on deps.dev
Purl: pkg:npm/remarkable

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-36m4-6v6m-4vpr/GHSA-36m4-6v6m-4vpr.json"