GHSA-5FF8-JCF9-FW62 Cross-Site Scripting in markdown-it-katex

All versions of markdown-it-katex are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error. Recommendation No fix is currently available. Consider using a...

42-markdown (>=1.0.0, <=1.0.1), @58fe/p5 (>=1.3.1, <=2.4.8) +413 more potentially affected by unknown CVE via markdown-it-katex (>=1.1.0, <=2.0.3)

markdown-it-katex NPM version =1.1.0, =1.0.0, =1.3.1, =2.3.0, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =3.0.0, =0.14.0, =1.1.7, =1.0.0, =1.5.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5FF8-JCF9-FW62...

@aconex/styleguide (>=2.0.1, <=2.2.0) potentially affected by unknown CVE via markdown-it-toc-and-anchor (4.1.2)

markdown-it-toc-and-anchor NPM version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it-toc-and-anchor and may be impacted: - @aconex/styleguide =2.0.1, =2.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-X6M6-5HRF-FH6R...

Denial of Service in markdown-it-toc-and-anchor

All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

GHSA-X6M6-5HRF-FH6R Denial of Service in markdown-it-toc-and-anchor

All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

Cross-site Scripting (XSS)

markdown-it-katex is vulnerable to cross-site scripting. The vulnerability exists in index.js once the parser return an error it returns katex without sanitizing as HTML tags, allowing a malicious user to inject and execute arbitrary web scripts...

Cross-Site Scripting

Overview All versions of markdown-it-katex are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error. Recommendation No fix is currently available. Conside...

Denial Of Service (DoS)

markdown-it is vulnerable to denial of service. The parsing of a malicious string such as multiple results in quadratic processing time, which could potentially be abused to cause a denial of service condition in the application...

Denial of Service

Overview All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

DEBIAN-CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs...

CVE-2015-3295

markdown-it before 4.1.0 does not block data: URLs, enabling potential HTML injection when rendering user-provided content. Affected: markdown-it versions prior to 4.1.0. Root cause: failure to block data: URLs in the rendering process. Impact: authoring or rendering content could lead to uninten...

CVE-2015-3295: Improper Access Control

markdown-it before 4.1.0 does not block data: URLs...

markdown-it and NodeBB HTML injection vulnerability (CNVD-2016-00135)

markdown-it is a parser product. NodeBB is a forum system developed by the Design Create Play team and built using Node.js, a web application platform built on top of Google's V8 JavaScript engine. An HTML injection vulnerability exists in markdown-it versions prior to 4.1.0 and NodeBB versions...

markdown-it and NodeBB HTML Injection Vulnerabilities

markdown-it is a parser product. NodeBB is a forum system developed by the Design Create Play team and built using Node.js, a web application platform built on top of Google's V8 JavaScript engine. An HTML injection vulnerability exists in markdown-it versions prior to 4.1.0 and NodeBB versions...