Cross site scripting

2019-08-2304:15:00

PRIOn knowledge base

www.prio-n.com

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.3%

JSON

CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.

CPENameOperatorVersion
codimdeq1.3.1

CPE	Name	Operator	Version
	codimd	eq	1.3.1

References

github.com/hackmdio/codimd/issues/1263