Cross-Site Scripting in react-marked-markdown

All versions of react-marked-markdown are vulnerable to cross-site scripting XSS via href attributes. This is exploitable if user is provided to react-marked-markdown Proof of concept: import React from 'react' import ReactDOM from 'react-dom' import MarkdownPreview from 'react-marked-markdown'...

CVE-2019-12184

There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136...

CVE-2019-12184

CVE-2019-12184 affects BoostIO Boostnote 0.11.15. The vulnerability is an XSS in browser/components/MarkdownPreview.js triggered via a label named flowchart, sequence, gallery, or chart, demonstrated by a crafted SRC attribute of an IFRAME element. The connected Red Hat CVE-2019-12184 entry mirro...