@clue/webpack-polyfills-plugin (0.0.9), @helpdotcom/help-gen (1.0.0) +39 more potentially affected by unknown CVE via marky-markdown (>=4.0.0, <=12.0.0)

marky-markdown NPM version =4.0.0, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.7.3-alpha, =0.1.0, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.34, =1.0.0, =1.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MG69-6J3M-JVGW...

HTML Injection in marky-markdown

All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. Recommendation This package is no longer maintained. Please upgrade to...

GHSA-MG69-6J3M-JVGW HTML Injection in marky-markdown

All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. Recommendation This package is no longer maintained. Please upgrade to...

Denial Of Service (DoS)

markdown-it-toc-and-anchor is vulnerable to denial of service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop...

PT-2020-21035

Name of the Vulnerable Software and Affected Versions simple-markdown versions prior to 0.5.2 Description The issue concerns a Regular Expression Denial of Service ReDoS that affects the performance of the SimpleMarkdown.defaultInlineParse function when parsing inline code blocks. Recommendations...

PT-2020-21447

Name of the Vulnerable Software and Affected Versions marky-markdown versions all Description The issue is related to HTML Injection due to a validation bypass in the marky-markdown package. Specifically, the package is designed to only allow iframes with sources from youtube.com, but this...

PT-2020-21234

Name of the Vulnerable Software and Affected Versions markdown-to-jsx versions prior to 6.11.4 Description The issue is related to Cross-Site Scripting due to insufficient input sanitization, allowing the package to render output containing malicious JavaScript. This can be exploited through inpu...

PT-2020-21403

Name of the Vulnerable Software and Affected Versions marky-markdown versions all versions Description The issue concerns HTML Injection due to the failure to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML...

PT-2020-21439

Name of the Vulnerable Software and Affected Versions hexo-admin versions all versions Description The issue concerns a failure to sanitize rendered markdown, which allows attackers to execute arbitrary JavaScript in a victim's browser if they can create new posts. This is a Cross-Site Scripting...

GHSA-PQPP-2363-649V Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, buttle does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. Recommendation No fix is currently available. Consider...

Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, buttle does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. Recommendation No fix is currently available. Consider...

PT-2020-21444

Name of the Vulnerable Software and Affected Versions buttle versions all Description The issue is related to Cross-Site Scripting due to a misconfiguration of the rendering engine in buttle, which fails to sanitize HTML output. This allows attackers to execute arbitrary JavaScript when processin...

@aconex/styleguide (>=2.0.1, <=2.2.0) potentially affected by unknown CVE via markdown-it-toc-and-anchor (4.1.2)

markdown-it-toc-and-anchor NPM version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it-toc-and-anchor and may be impacted: - @aconex/styleguide =2.0.1, =2.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-X6M6-5HRF-FH6R...

Denial of Service in markdown-it-toc-and-anchor

All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

GHSA-X6M6-5HRF-FH6R Denial of Service in markdown-it-toc-and-anchor

All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@toc causes the application to enter and infinite loop. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

@addaps/doca-addaps-theme (>=1.0.1, <=1.0.6), doca-bootstrap-theme (>=0.0.6, <=1.0.0) +11 more potentially affected by unknown CVE via react-marked-markdown (1.4.6)

react-marked-markdown NPM version 1.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on react-marked-markdown and may be impacted: - @addaps/doca-addaps-theme =1.0.1, =0.0.6, =0.0.1, =0.2.1, =1.0.0, =0.0.1, =1.0.0, =0.1.1, =0.15.1, =0.1.2, =0.2.1 Sourc...

GHSA-M7QM-R2R5-F77Q Cross-Site Scripting in react-marked-markdown

All versions of react-marked-markdown are vulnerable to cross-site scripting XSS via href attributes. This is exploitable if user is provided to react-marked-markdown Proof of concept: import React from 'react' import ReactDOM from 'react-dom' import MarkdownPreview from 'react-marked-markdown'...

PT-2020-21344

Name of the Vulnerable Software and Affected Versions mrk.js versions prior to 2.0.1 Description The issue concerns cross-site scripting XSS that occurs when markdown is converted to HTML. Recommendations Update to version 2.0.1 or later and use mark.sanitizeURL for any src and href attributes wh...

PT-2020-21395

Name of the Vulnerable Software and Affected Versions react-marked-markdown versions affected versions not specified Description The issue concerns cross-site scripting XSS via href attributes in react-marked-markdown. This can be exploited when a user is provided to react-marked-markdown. There ...

PT-2020-21582

Name of the Vulnerable Software and Affected Versions markdown-it-toc-and-anchor versions affected versions not specified Description The issue allows for a Denial of Service. It occurs when parsing markdown that contains text+ @toc, causing the application to enter an infinite loop...