@codecademy/gamut (>=1.10.10-alpha.7c13cf.0, <=1.15.2), @contentful/field-editor-markdown (>=0.1.0, <=0.4.0) +18 more potentially affected by unknown CVE via markdown-to-jsx (>=6.4.1, <=6.11.1)

markdown-to-jsx NPM version =6.4.1, =1.10.10-alpha.7c13cf.0, =0.1.0, =0.1.0, =0.0.9, =7.1.0, =0.10.0, =1.0.0, =0.2.0, =0.1.0, =5.11.3, =5.8.9, =6.0.1, =1.0.0, =3.3.1-feather.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-CCRP-C664-8P4J...

GHSA-CCRP-C664-8P4J Cross-Site Scripting in markdown-to-jsx

Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encode...

Cross-Site Scripting in markdown-to-jsx

Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encode...

Cross-Site Scripting in hexo-admin

All versions of hexo-admin are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a victim's browser if they are able to create new posts. Recommendation No fix is currently available. Consider using an...

Duplicate Advisory: Regular Expression Denial of Service in simple-markdown

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gpvj-gp8c-c7p2. This link is maintained to preserve external references. Original Description Versions of simple-markdown prior to 0.5.2 are vulnerable to Regular Expression Denial of Service ReDoS. The...

GHSA-4XF9-PGVV-XX67 Duplicate Advisory: Regular Expression Denial of Service in simple-markdown

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gpvj-gp8c-c7p2. This link is maintained to preserve external references. Original Description Versions of simple-markdown prior to 0.5.2 are vulnerable to Regular Expression Denial of Service ReDoS. The...

20190403-utils (1.0.0), 30s (>=0.1.0, <=1.3.3) +2467 more potentially affected by unknown CVE via marked (>=0.4.0, <=0.6.3)

marked NPM version =0.4.0, =0.1.0, =1.0.0, =4.13.7-rc4, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =4.0.0, =1.0.0, =2.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-CH52-VGQ2-943F...

HTML Injection in marky-markdown

All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co. This Recommendatio...

GHSA-PXMP-FWJC-4X7Q HTML Injection in marky-markdown

All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co. This Recommendatio...

@clue/webpack-polyfills-plugin (0.0.9), @helpdotcom/help-gen (1.0.0) +39 more potentially affected by unknown CVE via marky-markdown (>=4.0.0, <=12.0.0)

marky-markdown NPM version =4.0.0, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.7.3-alpha, =0.1.0, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.34, =1.0.0, =1.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-PXMP-FWJC-4X7Q...

HTML Injection in marky-markdown

All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. Recommendation This package is no longer maintained. Please upgrade to...

@clue/webpack-polyfills-plugin (0.0.9), @helpdotcom/help-gen (1.0.0) +39 more potentially affected by unknown CVE via marky-markdown (>=4.0.0, <=12.0.0)

marky-markdown NPM version =4.0.0, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.7.3-alpha, =0.1.0, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.34, =1.0.0, =1.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MG69-6J3M-JVGW...

GHSA-MG69-6J3M-JVGW HTML Injection in marky-markdown

All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. Recommendation This package is no longer maintained. Please upgrade to...

Denial Of Service (DoS)

markdown-it-toc-and-anchor is vulnerable to denial of service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop...

PT-2020-21403

Name of the Vulnerable Software and Affected Versions marky-markdown versions all versions Description The issue concerns HTML Injection due to the failure to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML...

PT-2020-21035

Name of the Vulnerable Software and Affected Versions simple-markdown versions prior to 0.5.2 Description The issue concerns a Regular Expression Denial of Service ReDoS that affects the performance of the SimpleMarkdown.defaultInlineParse function when parsing inline code blocks. Recommendations...

PT-2020-21234

Name of the Vulnerable Software and Affected Versions markdown-to-jsx versions prior to 6.11.4 Description The issue is related to Cross-Site Scripting due to insufficient input sanitization, allowing the package to render output containing malicious JavaScript. This can be exploited through inpu...

PT-2020-21439

Name of the Vulnerable Software and Affected Versions hexo-admin versions all versions Description The issue concerns a failure to sanitize rendered markdown, which allows attackers to execute arbitrary JavaScript in a victim's browser if they can create new posts. This is a Cross-Site Scripting...

PT-2020-21447

Name of the Vulnerable Software and Affected Versions marky-markdown versions all Description The issue is related to HTML Injection due to a validation bypass in the marky-markdown package. Specifically, the package is designed to only allow iframes with sources from youtube.com, but this...

Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, buttle does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. Recommendation No fix is currently available. Consider...