Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlyMjctOTk0Yy00eGNo

discord-html not escaping HTML code blocks when lacking a language identifier

Impact

Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.

Patches

This has been patched in version 2.3.1

Workarounds

Escape the characters <>& before sending plain code blocks to discord-markdown.

References

https://github.com/brussell98/discord-markdown/issues/13

Permalink: https://github.com/advisories/GHSA-9r27-994c-4xch
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlyMjctOTk0Yy00eGNo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 4 years ago
Updated: over 1 year ago

Identifiers: GHSA-9r27-994c-4xch
References:

• https://github.com/brussell98/discord-markdown/security/advisories/GHSA-9r27-994c-4xch
• https://github.com/brussell98/discord-markdown/issues/13
• https://github.com/brussell98/discord-markdown/commit/7ce2eb66520815dcf5e97ef2bc8a2d5979da66e7
• https://github.com/advisories/GHSA-9r27-994c-4xch

Repository: https://github.com/brussell98/discord-markdown
Blast Radius: 0.0

Affected Packages