Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhyNTMtbTkzNy1qcjlj

Cross-Site Scripting in ngx-md

Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as [Click Me](javascript:alert('Injected!'%29) is rendered as a Click Me link that executes JavaScript.

Recommendation

Upgrade to version 6.0.3 or later.

Permalink: https://github.com/advisories/GHSA-xr53-m937-jr9c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhyNTMtbTkzNy1qcjlj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 3 years ago
Updated: over 1 year ago

Identifiers: GHSA-xr53-m937-jr9c
References:

• https://github.com/dimpu/ngx-md/issues/129
• https://www.npmjs.com/advisories/1485
• https://github.com/advisories/GHSA-xr53-m937-jr9c

Repository: https://github.com/dimpu/ngx-md
Blast Radius: 0.0

Affected Packages