GHSA-4r9g-w48q-8jwm

Source

https://github.com/advisories/GHSA-4r9g-w48q-8jwm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-4r9g-w48q-8jwm/GHSA-4r9g-w48q-8jwm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4r9g-w48q-8jwm

Aliases

CVE-2022-25849

Published

2022-10-26T12:00:29Z

Modified

2023-11-08T04:08:49Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

HyperDown vulnerable to Cross-site Scripting

Details

HyperDown is a markdown parser written for the Chinese website SegmentFault. Improper validation of the href attribute allows for Cross-site Scripting. At publication there are no patched versions, and no known workarounds.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-10-26T22:42:45Z",
    "nvd_published_at":  "2022-10-26T05:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / joyqi/hyper-down

Package

Name: joyqi/hyper-down
Purl: pkg:composer/joyqi/hyper-down

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2.4.27

Affected versions

2.*

2.4.9

2.4.10

2.4.13

2.4.14

2.4.15

2.4.16

2.4.17

2.4.18

2.4.19

2.4.20

2.4.21

2.4.23

2.4.24

2.4.25

2.4.26

2.4.27

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-4r9g-w48q-8jwm/GHSA-4r9g-w48q-8jwm.json"