GHSA-hpr5-wp7c-hh5q

Source

https://github.com/advisories/GHSA-hpr5-wp7c-hh5q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-hpr5-wp7c-hh5q/GHSA-hpr5-wp7c-hh5q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hpr5-wp7c-hh5q

Published

2020-09-01T19:37:29Z

Modified

2021-09-23T21:50:21Z

Summary

Cross-Site Scripting in mrk.js

Details

Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.

Recommendation

Update to version 2.0.1 or later and use mark.sanitizeURL() for any src and href attributes when extending the markdown.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:28:53Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

npm / mrk.js

Package

Name: mrk.js; View open source insights on deps.dev
Purl: pkg:npm/mrk.js

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-hpr5-wp7c-hh5q/GHSA-hpr5-wp7c-hh5q.json"