GHSA-9r27-994c-4xch

Source

https://github.com/advisories/GHSA-9r27-994c-4xch

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-9r27-994c-4xch/GHSA-9r27-994c-4xch.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9r27-994c-4xch

Published

2020-02-24T17:34:02Z

Modified

2020-02-21T20:20:53Z

Summary

discord-html not escaping HTML code blocks when lacking a language identifier

Details

Impact

Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.

Patches

This has been patched in version 2.3.1

Workarounds

Escape the characters <>& before sending plain code blocks to discord-markdown.

References

https://github.com/brussell98/discord-markdown/issues/13

Database specific

{
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2020-02-21T20:20:53Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

npm / discord-markdown

Package

Name: discord-markdown; View open source insights on deps.dev
Purl: pkg:npm/discord-markdown

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.3.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-9r27-994c-4xch/GHSA-9r27-994c-4xch.json"