CVE-2021-27671

An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing for example Data: to be used in an attack...

CVE-2021-27671

The CVE-2021-27671 issue affects the comrak crate for Rust (pre-0.9.1). The root cause is a case-sensitive protection check for data: and javascript: URLs, allowing data: URLs to bypass the guard and enable cross-site scripting (XSS). This is described consistently across sources (NVD entry and R...

Mozilla Rust 跨站脚本漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A cross-site scripting vulnerability exists in Rust in versions prior to comrak crate 0.9.1, which stems from the fact that the protection mechanism for data: and javascript: URIs is case-sensitive. No details o...

RUSTSEC-2021-0026 XSS in `comrak`

The comrak we were matching unsafe URL prefixes, such as data: or javascript: , in a case-sensitive manner. This meant prefixes like Data: were untouched...

atomic-server (>=0.10.0, <=0.17.0), basic-http-server (>=0.6.0, <=0.8.1) +40 more potentially affected by CVE-2021-27671 via comrak (>=0.1.9, <=0.8.2)

comrak CARGO version =0.1.9, =0.10.0, =0.6.0, =0.1.0, =0.1.5, =0.1.0, =0.0.1, =0.15.0, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.7 and more Source cves: CVE-2021-27671 Source advisory: OSV:RUSTSEC-2021-0026...