CVE-2020-26237

Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow use...

@halo-dev/markdown-renderer (>=1.0.0-alpha.11, <=1.0.0-alpha.50), @jx3box/jx3box-bmap (>=0.0.1, <=0.1.15) +119 more potentially affected by CVE-2020-28455 via markdown-it-toc (1.1.0)

markdown-it-toc NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it-toc and may be impacted: - @halo-dev/markdown-renderer =1.0.0-alpha.11, =0.0.1, =1.8.9, =5.4.2, =1.0.3, =0.0.1, =0.1.5, =0.1.0, =0.0.1, =0.1.1, =1.0.6, =0.0.1...

Cross-site Scripting (XSS)

Overview markdown-it-toc is an Adds syntax for an automatically generated table of contents to markdown-it markdown parser. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The title of the generated toc and the contents of the header are not escaped. PoC // XSS from...

@jamen/mdc (>=0.0.0, <=0.0.1), @namgoe/gcmsgen (>=0.0.3, <=0.0.11) +25 more potentially affected by CVE-2020-28459 via markdown-it-decorate (>=1.0.0, <=1.2.2)

markdown-it-decorate NPM version =1.0.0, =0.0.0, =0.0.3, =0.0.1, =0.0.0, =2.3.0, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =1.1.0, =0.1.0, =0.2.0, =1.0.1, =1.0.1, =1.0.17 and more Source cves: CVE-2020-28459 Source advisory: SNYK:JS-MARKDOWNITDECORATE-1044068...

Cross-site Scripting (XSS)

Overview markdown-it-decorate is an Add classes, identifiers and attributes to your markdown with HTML comments Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker can add an event handler or use javascript:xxx for the link. PoC const md = require'markdown-it...

CVE-2020-26237: Modification of Assumed-Immutable Data (MAID)

Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow use...

Stored XSS in markdown file with Nextcloud Talk using Internet Explorer (NC-SA-2021-002)

A missing link validation in Nextcloud Server 20.0.1 allowed to execute a stored XSS attack on Internet Explorer users by saving a javascript url in a Markdown...

Valeriangalliat Markdown It Highlightjs Cross-Site Scripting Vulnerability

Valeriangalliat Markdown It Highlightjs is Valeriangalliat individual developers of a Js code base for Web page Markdown highlighting . A cross-site scripting vulnerability exists in markdown-it-highlightjs versions prior to 3.3.1, which stems from the ability to insert malicious JavaScript as th...

CVE-2020-7773

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...

CVE-2020-7773

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...

Code injection

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...

@boyuai/fe-base (>=0.37.0, <=0.42.6), @boyuai/markdown (>=0.1.0, <=0.6.0) +29 more potentially affected by unknown CVE via markdown-it-texmath (>=0.4.7, <=0.8.0)

markdown-it-texmath NPM version =0.4.7, =0.37.0, =0.1.0, =0.1.1, =0.2.1, =0.0.1, =0.0.7, =1.0.0, =2.15.3-alpha.0, =1.1.0, =0.1.0, =0.1.0, =0.6.0, =1.3.5 - @navanjr/vuetify-markdown-editor 1.0.0 - @suehok/vuetify-markdown-editor 3.3.4 and more Source cves: unknown CVE Source advisory:...

Cross-site Scripting (XSS)

Overview markdown-it-texmath is a that add TeX math equations to your Markdown documents rendered by markdown-it parser. Affected versions of this package are vulnerable to Cross-site Scripting XSS. Within texmath.js, it is possible to bypass the current validation and inject JavaScript within ma...

CVE-2020-7773

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...

CVE-2020-7773 Cross-site Scripting (XSS)

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...

CVE-2020-7773

This CVE affects the JavaScript package markdown-it-highlightjs before version 3.3.1 . The vulnerability stems from the ability to inject malicious JavaScript through the lang value used in the package’s inline code highlighting feature, enabling XSS in affected renderings (example payload shown ...

CVE-2020-7773

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...

@decentralized-identity/sidetree (>=0.10.0-unstable.0042dcd, <=1.0.1), spec-up (>=0.9.0, <=0.10.1) +2 more potentially affected by unknown CVE via markdown-it-prism (>=2.0.3, <=2.1.2)

markdown-it-prism NPM version =2.0.3, =0.10.0-unstable.0042dcd, =0.9.0, =1.1.11, =0.10.1, =0.11.1-preview.1 Source cves: unknown CVE Source advisory: SNYK:JS-MARKDOWNITPRISM-1040462...

Cross-site Scripting (XSS)

Overview markdown-it-prism is a The plugin will insert the necessary markup into all code blocks. Include one of Prism’s stylesheets in your HTML to get highlighted code. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It is possible to insert malicious JavaScript as...

@wulechuan/generate-html-via-markdown (>=3.0.0, <=3.0.1), norska (>=0.6.0, <=0.16.0) +3 more potentially affected by CVE-2020-7773 via markdown-it-highlightjs (>=3.0.0, <=3.3.0)

markdown-it-highlightjs NPM version =3.0.0, =3.0.0, =0.6.0, =0.6.0, =0.2.2, =0.2.4 Source cves: CVE-2020-7773 Source advisory: SNYK:JS-MARKDOWNITHIGHLIGHTJS-1040461...