Cross-site Scripting in markdown-it-highlightjs

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. js const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...

Uncontrolled Resource Consumption in markdown-it

Impact Special patterns with length 50K chars can slow down parser significantly. js const md = require'markdown-it'; md.renderx $' '.repeat150000 x \nx; Patches Upgrade to v12.3.2+ Workarounds No. References Fix + test sample:...

4xx (0.0.1), @actinc/eslint-config (>=3.1.0, <=3.4.0) +151 more potentially affected by CVE-2022-21670 via markdown-it (>=12.0.0, <=12.3.1)

markdown-it NPM version =12.0.0, =3.1.0, =11.23.7, =0.1.0, =0.0.2, =0.3.2, =5.4.0, =0.0.1, =1.4.48, =0.12.2, =0.1.1, =1.1.43-beta.3, =1.6.0, =2.1.1 and more Source cves: CVE-2022-21670 Source advisory: GHSA-6VFC-QV3F-VR6C...

4xx (0.0.1), @actinc/eslint-config (>=3.1.0, <=3.4.0) +151 more potentially affected by CVE-2022-21670 via markdown-it (>=12.0.0, <=12.3.1)

markdown-it NPM version =12.0.0, =3.1.0, =11.23.7, =0.1.0, =0.0.2, =0.3.2, =5.4.0, =0.0.1, =1.4.48, =0.12.2, =0.1.1, =1.1.43-beta.3, =1.6.0, =2.1.1 and more Source cves: CVE-2022-21670 Source advisory: OSV:GHSA-6VFC-QV3F-VR6C...

GHSA-6VFC-QV3F-VR6C Uncontrolled Resource Consumption in markdown-it

Impact Special patterns with length 50K chars can slow down parser significantly. js const md = require'markdown-it'; md.renderx $' '.repeat150000 x \nx; Patches Upgrade to v12.3.2+ Workarounds No. References Fix + test sample:...

CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

DEBIAN-CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

UBUNTU-CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

Code injection

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

0xrtest (1.0.0), 20ful (>=0.1.0, <=0.3.3) +7321 more potentially affected by CVE-2022-21670 via markdown-it (>=2.1.3, <=12.3.1)

markdown-it NPM version =2.1.3, =0.1.0, =1.0.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =0.5.2, =0.0.2, =0.0.6 and more Source cves: CVE-2022-21670 Source advisory: MEND:CVE-2022-21670...

CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

CVE-2022-21670

CVE-2022-21670 affects the markdown-it Markdown parser. The vulnerability arises from handling of special patterns with length over 50,000 characters, which can cause significant slowdown (denial of service) in affected versions. The issue is addressed by upgrading to version 12.3.2 ; there are n...

CVE-2022-21670 Uncontrolled Resource Consumption in markdown-it

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

PT-2022-15024

Name of the Vulnerable Software and Affected Versions markdown-it versions prior to 12.3.2 Description The issue concerns a Markdown parser that can be significantly slowed down by special patterns with lengths greater than 50 thousand characters. There are no known real-world incidents or...

CVE-2022-21670: Uncontrolled Resource Consumption

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

Markdown-It resource management error vulnerability

Markdown-It is a Markdown parser. A security vulnerability exists in Markdown-It, which originates from Markdown-It is a Markdown parser. Prior to version 1.3.2, special patterns greater than 50,000 characters in length significantly slowed down the parser. Users should upgrade to version 12.3.2 ...

@halo-dev/markdown-renderer (>=1.0.0-alpha.11, <=1.0.0-alpha.50), @jx3box/jx3box-bmap (>=0.0.1, <=0.1.15) +119 more potentially affected by CVE-2020-28455 via markdown-it-toc (1.1.0)

markdown-it-toc NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it-toc and may be impacted: - @halo-dev/markdown-renderer =1.0.0-alpha.11, =0.0.1, =1.8.9, =5.4.2, =1.0.3, =0.0.1, =0.1.5, =0.1.0, =0.0.1, =0.1.1, =1.0.6, =0.0.1...

Cross-site Scripting (XSS)

Overview markdown-it-toc is an Adds syntax for an automatically generated table of contents to markdown-it markdown parser. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The title of the generated toc and the contents of the header are not escaped. PoC // XSS from...

@jamen/mdc (>=0.0.0, <=0.0.1), @namgoe/gcmsgen (>=0.0.3, <=0.0.11) +25 more potentially affected by CVE-2020-28459 via markdown-it-decorate (>=1.0.0, <=1.2.2)

markdown-it-decorate NPM version =1.0.0, =0.0.0, =0.0.3, =0.0.1, =0.0.0, =2.3.0, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =1.1.0, =0.1.0, =0.2.0, =1.0.1, =1.0.1, =1.0.17 and more Source cves: CVE-2020-28459 Source advisory: SNYK:JS-MARKDOWNITDECORATE-1044068...