PT-2017-12128

Name of the Vulnerable Software and Affected Versions Loomio versions prior to 1.8.0 Description A cross-site scripting XSS issue exists in the Markdown parser, allowing remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment...

CVE-2017-11594: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment...

Discourse: XSS Vulnerability on Image link parser

I found a XSS Cross-Site Scripting vulnerability, and it is present in the markdown parser when it tries to parse an image URL. To reproduce the vulnerability you need to add a fake image url like: http://host/path/to/image'onerror=alert1;//.png As you can see, we have an invalid image URL which...