300 matches found
CVE-2026-105829 League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass
League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone script or iframe line followed by a block supplying...
CVE-2026-105829
The League CommonMark library (versions 1.3.0 before 2.10.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a bypass in the DisallowedRawHtml extension, where an attacker can evade restrictions by ending a raw HTML tag with a bare disallowed tag name. By placing a l...
Rocky Linux 8 [CIQ] Security Update: pandoc / pandoc-common (crlsa-2025_8427)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258427 advisory. cmark-gfm: Quadratic complexity bugs may lead to a denial of service CVE-2023-24824 Tenable has extracted the preceding description block directly from the CIQ...
Rocky Linux 8 [CIQ] Security Update: pandoc / pandoc-common (crlsa-2022_5597)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20225597 advisory. cmark-gfm: possible RCE due to integer overflow CVE-2022-24724 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...
CLEANSTART-2024-CU29214 cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C
Security vulnerability affects the cmark package. cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C...
CVE-2026-5389
justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...
pandoc security update
An update is available for pandoc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Pandoc is a markdown/markup conversion tool. The version of pandoc in Rocky...
RLSA-2022:5597 Important: pandoc security update
Pandoc is a markdown/markup conversion tool. The version of pandoc in Rocky Linux 8 CRB uses cmark-gfm GitHub's extended version of the C reference implementation of CommonMark for parts of its conversion. The update, fixes CVE-2022-24724: an integer overflow in cmark-gfm's table row parsing whic...
RockyLinux 8 : pandoc (RLSA-2022:5597)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5597 advisory. cmark-gfm: possible RCE due to integer overflow CVE-2022-24724 Tenable has extracted the preceding description block directly from the RockyLinux security advisor...
Malicious Package
Overview remark-gfm-v4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in remark-gfm-v4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eb645996981f1453b9049a0d97b6f0b6c7ff4cadc29d4ccddd7f48cd65cbb21 The package remark-gfm-v4 was found to contain malicious code. Source: ghsa-malware 10eecf76003bd92639bb172deaa68448c44a5899c772fdcce927765011d807eb...
MAL-2026-737 Malicious code in remark-gfm-v4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eb645996981f1453b9049a0d97b6f0b6c7ff4cadc29d4ccddd7f48cd65cbb21 The package remark-gfm-v4 was found to contain malicious code. Source: ghsa-malware 10eecf76003bd92639bb172deaa68448c44a5899c772fdcce927765011d807eb...
Malware in remark-gfm-v4
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MiracleLinux 8 : pandoc-2.0.6-6.el8 (AXSA:2022-3835:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3835:01 advisory. cmark-gfm: possible RCE due to integer overflow CVE-2022-24724 Tenable has extracted the preceding description block directly from the MiracleLinux security...
HSEC-2025-0007 cmark-gfm: resource exhaustion due to quadratic complexity in parser
cmark-gfm: resource exhaustion due to quadratic complexity in parser cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service, due to...
TencentOS Server 4: python-cmarkgfm (TSSA-2025:0086)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0086 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
EUVD-2018-9715
Malware in sbrugna...
EUVD-2023-30291
Malicious code in bioql PyPI...