5039 matches found
CVE-2025-59053
Affected software and version: AIRI v0.7.2-beta.2 (Grok Companion) with vulnerable Markdown rendering in packages/stage-ui/src/components/MarkdownRenderer.vue and insecure MCP command interface. Root cause: Markdown is processed via useMarkdown and rendered with v-html without escaping, enabling ...
CVE-2025-59053 AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE
AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...
CVE-2025-59053 AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE
AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...
Malicious Package
Overview react-markdown-v7 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PT-2025-37257
Name of the Vulnerable Software and Affected Versions: AIRI versions 0.7.2-beta.2 Description: AIRI is a self-hosted, artificial intelligence based Grok Companion. The application processes Markdown content using the useMarkdown composable and renders it directly into the DOM using v-html. An...
Project AIRI 代码注入漏洞
Project AIRI is an AI dialog bot open-sourced by moeru-ai. Project AIRI version 0.7.2-beta.2 suffers from a code injection vulnerability that stems from the MarkdownRenderer.vue component directly using v-html to render unescaped HTML content, which could lead to cross-site scripting attacks, as...
Linux Distros Unpatched Vulnerability : CVE-2022-31175
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions...
Linux Distros Unpatched Vulnerability : CVE-2021-21391
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list,...
Linux Distros Unpatched Vulnerability : CVE-2023-6396
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitlab reports: XSS and ReDoS in Markdown via Banzai pipeline of Jira Members with admingroupmember custom permission can add members with higher role Release...
Linux Distros Unpatched Vulnerability : CVE-2015-10005
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/htmlre.js. The...
Regular Expression Denial of Service (ReDoS)
Overview cattown is an A lightweight, pure JavaScript markdown parser with built-in HTML sanitization using DOMPurify. Converts markdown to clean, safe HTML with customizable styling. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via inefficient...
CVE-2025-58451
Cattown is a JavaScript markdown parser. Versions prior to 1.0.2 used regular expressions with inefficient, potentially exponential worst-case complexity. This could cause excessive CPU usage due to excessive backtracking on crafted inputs. In turn, the excessive CPU usage could lead to resource...
Cattown 安全漏洞
Cattown is a markdown file parser for IEatUranium238 individual developers. A security vulnerability exists in Cattown versions prior to 1.0.2 that stems from a denial of service attack with regular expressions...
PT-2025-36518
Name of the Vulnerable Software and Affected Versions: Cattown versions prior to 1.0.2 Description: Cattown is a JavaScript markdown parser susceptible to denial of service. The parser utilizes regular expressions with inefficient complexity, potentially leading to exponential worst-case...
Malicious code in oscillation-prettier-plugin-markdown-joviology-cluster (npm)
The package oscillation-prettier-plugin-markdown-joviology-cluster was found to contain malicious code...
Malicious code in rimraf-prettier-plugin-markdown-sequelize-jupiter (npm)
The package rimraf-prettier-plugin-markdown-sequelize-jupiter was found to contain malicious code...
Malicious code in quark-markdown-soap-jekyll (npm)
The package quark-markdown-soap-jekyll was found to contain malicious code...
Malicious code in middleware-markdown-pdf-entanglement-relay (npm)
The package middleware-markdown-pdf-entanglement-relay was found to contain malicious code...