Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY5dmMtcTNoaC1xaGZ2

Content Injection in remarkable

Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly whitelist link protocols, and consequently allowed javascript: to be used.

Proof of Concept

Markdown Source:

[link](<javascript:alert(1)>)

Rendered HTML:

<a href="javascript:alert(1)">link</a>

Recommendation

Update to version 1.4.1 or later

Permalink: https://github.com/advisories/GHSA-f9vc-q3hh-qhfv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY5dmMtcTNoaC1xaGZ2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 3 years ago
Updated: about 1 year ago

Identifiers: GHSA-f9vc-q3hh-qhfv, CVE-2014-10065
References:

• https://github.com/jonschlinkert/remarkable/issues/97
• https://www.npmjs.com/advisories/30
• https://nvd.nist.gov/vuln/detail/CVE-2014-10065
• https://github.com/jonschlinkert/remarkable/commit/d54ed887f4997221cd7cb9790e953a83c504de36
• https://github.com/advisories/GHSA-f9vc-q3hh-qhfv

Repository: https://github.com/jonschlinkert/remarkable
Blast Radius: 0.0

Affected Packages