BIT-MATTERMOST-2020-14450

An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service client-side, aka MMSA-2020-0017...

BIT-REDMINE-2023-47258

Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter...

BIT-MATTERMOST-2023-3593

Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input...

BIT-JUPYTERLAB-2024-22420 Stored cross site scripting in Markdown Preview in JupyterLab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the...

BIT-JUPYTER-NOTEBOOK-2024-22420 Stored cross site scripting in Markdown Preview in JupyterLab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the...

BIT-JUPYTER-BASE-NOTEBOOK-2024-22420 Stored cross site scripting in Markdown Preview in JupyterLab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the...

Remote Code Execution(RCE)

Nteract is vulnerable to Remote Code Execution RCE. The vulnerability is caused due to a lack of input validation in the Markdown link parsing functionality, allowing malicious actors to execute arbitrary code remotely...

Nteract Remote Code Execution vulnerability

Nteract v.0.28.0 was discovered to contain a remote code execution RCE vulnerability via the Markdown link...

GHSA-6JVG-HP25-42F6 Nteract Remote Code Execution vulnerability

Nteract v.0.28.0 was discovered to contain a remote code execution RCE vulnerability via the Markdown link...

CVE-2024-22891

Nteract v.0.28.0 was discovered to contain a remote code execution RCE vulnerability via the Markdown link...

CVE-2024-22891

Nteract v.0.28.0 was discovered to contain a remote code execution RCE vulnerability via the Markdown link...

Remote code execution

Nteract v.0.28.0 was discovered to contain a remote code execution RCE vulnerability via the Markdown link...

CVE-2024-22891

Nteract v.0.28.0 was discovered to contain a remote code execution RCE vulnerability via the Markdown link...

PT-2024-19599 · Interact · Interact

Name of the Vulnerable Software and Affected Versions: Nteract version 0.28.0 Description: The issue is related to a remote code execution RCE vulnerability via the Markdown link. Recommendations: For Nteract version 0.28.0, update to a version that fixes the remote code execution vulnerability...

CVE-2024-22891

Nteract v.0.28.0 was discovered to contain a remote code execution RCE vulnerability via the Markdown link...

Nteract Security Vulnerabilities

Nteract is an ecosystem of React components, JavaScript packages, and applications built on the Jupyter specification from Nteract, Inc. A security vulnerability exists in Nteract version v.0.28.0, which stems from a Remote Code Execution RCE vulnerability in Markdown links...

CVE-2024-22891

CVE-2024-22891 affects Nteract v0.28.0 and is a Remote Code Execution (RCE) via Markdown links. The issue arises from using Electron WebView with nodeIntegration enabled in the Markdown parser, enabling an attacker to achieve RCE by crafting a link or shared file. The CVSS v3.1 impact is high (CV...

org.webjars:angular-markdown-directive (=0.3.0) potentially affected by CVE-2024-1899 via org.webjars:showdown (=0.3.1)

org.webjars:showdown MAVEN version =0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:showdown and may be impacted: - org.webjars:angular-markdown-directive =0.3.0 Source cves: CVE-2024-1899 Source advisory: SNYK:JAVA-ORGWEBJARS-8685134...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.bowergithub.showdownjs:showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the anchors subparser in anchors.js AKA links.js. PoC time node -e '/?:^|^\ ??:\n...

@apolitical/component-library (>=1.7.0 <=10.5.0), @apolitical/styleguide2 (>=3.17.0-rc.1 <=7.8.1) +57 more potentially affected by CVE-2024-21535 via markdown-to-jsx (>=7.0.0 <=7.3.2)

markdown-to-jsx NPM version =7.0.0, =1.7.0, =3.17.0-rc.1, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =6.1.1, =7.3.2, =0.1.0, =0.9.1, =0.1.0, =1.1.1, =0.2.36, =2.0.5, =2.0.12 and more Source cves: CVE-2024-21535 Source advisory: SNYK:JS-MARKDOWNTOJSX-6258886...