markdown-to-jsx 安全漏洞

markdown-to-jsx is one of the lightest, customizable React markdown components by Evan Jacobs Personal Developer. A security vulnerability exists in markdown-to-jsx prior to version 7.4.0 that stems from improper input cleanup...

@apolitical/component-library (>=1.7.0-beta.1, <=10.5.0), @apolitical/styleguide2 (>=3.17.0-rc.1, <=7.8.1) +60 more potentially affected by CVE-2024-21535 via markdown-to-jsx (>=7.0.0, <=7.3.2)

markdown-to-jsx NPM version =7.0.0, =1.7.0-beta.1, =3.17.0-rc.1, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =6.1.1, =7.3.2, =0.1.0, =0.9.1, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =0.1.0-alpha.39, =1.1.1-beta.3, =1.2.2 and more Source cves: CVE-2024-21535 Source advisory:...

Cross-site Scripting (XSS)

Overview markdown-to-jsx is a lightweight, customizable React markdown component. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in...

@codecademy/gamut (>=1.10.10-alpha.7c13cf.0, <=1.15.2), @contentful/field-editor-markdown (>=0.1.0, <=0.4.0) +18 more potentially affected by unknown CVE via markdown-to-jsx (>=6.4.1, <=6.11.1)

markdown-to-jsx NPM version =6.4.1, =1.10.10-alpha.7c13cf.0, =0.1.0, =0.1.0, =0.0.9, =7.1.0, =0.10.0, =1.0.0, =0.2.0, =0.1.0, =5.11.3, =5.8.9, =6.0.1, =1.0.0, =3.3.1-feather.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-CCRP-C664-8P4J...

Cross-Site Scripting in markdown-to-jsx

Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encode...

GHSA-CCRP-C664-8P4J Cross-Site Scripting in markdown-to-jsx

Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encode...

Cross-site Scripting (XSS)

markdown-to-jsx is vulnerable to cross-site scripting XSS. The attack exists because it does not sufficiently escape the input to the links containing data or VBScript URIs and a base64-encoded payload...

Cross-site Scripting (XSS)

markdown-to-jsx is vulnerable to cross-site scripting XSS attacks. The library does not properly convert tag names to lowercase before evaluating against the blacklist, allowing a malicious user to inject script and style tags by using uppercase letters...

Cross-Site Scripting

Overview Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a...