Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhwcjUtd3A3Yy1oaDVx

Cross-Site Scripting in mrk.js

Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.

Recommendation

Update to version 2.0.1 or later and use mark.sanitizeURL() for any src and href attributes when extending the markdown.

Permalink: https://github.com/advisories/GHSA-hpr5-wp7c-hh5q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhwcjUtd3A3Yy1oaDVx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

Identifiers: GHSA-hpr5-wp7c-hh5q
References:

• https://github.com/heyitsmeuralex/mrk/pull/3
• https://www.npmjs.com/advisories/587
• https://github.com/advisories/GHSA-hpr5-wp7c-hh5q

Repository: https://github.com/heyitsmeuralex/mrk
Blast Radius: 0.0

Affected Packages