234 matches found
GHSA-VCCX-P757-PV6H mo has a XSS via inline SVG script tags in Markdown rendering
Summary When rendering Markdown files containing inline SVG elements with tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML including SVG through to the DOM without sanitization. PoC html alert1 Embedding the above in a Markdown file opened with ...
CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...
CVE-2026-28509
LangBot’s web UI prior to version 4.8.7 renders user-supplied raw HTML via rehypeRaw, resulting in a cross-site scripting (XSS) vulnerability. Affected product: LangBot (global IM bot platform for LLMs). Root cause: unescaped user HTML processed by rehypeRaw. Impact (per CVSS): Confidentiality im...
CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...
CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...
LangBot 跨站脚本漏洞
LangBot is an open-source development platform for large-scale instant messaging robots created by LangBot. Versions of LangBot prior to 4.8.7 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of rehypeRaw to render the original HTML provided by users, which...
EUVD-2025-179550
Malicious code in cosmiconfig-xml-rehype-webpack npm...
EUVD-2025-176732
Malicious code in rehype-janus-nebula-quito npm...
EUVD-2025-176731
Malicious code in rehype-mesosphere-orbit-puppeteer npm...
EUVD-2025-179427
Malicious code in cz-conventional-changelog-ora-rehype-xanadu npm...
EUVD-2025-176730
Malicious code in rehype-sequelize-avior-redis npm...
EUVD-2025-175994
Malicious code in test-cache-rehype-backend npm...
EUVD-2025-177842
Malicious code in middleware-fusion-gemini-rehype npm...
EUVD-2025-178544
Malicious code in hercules-pyxis-rehype-hermes npm...
EUVD-2025-176733
Malicious code in rehype-darkenergy-neptune-taphonomy npm...
EUVD-2025-180466
Malicious code in aldebaran-resolvers-rehype-carina npm...
EUVD-2025-175799
Malicious code in update-hadron-rehype-phoenix npm...
MAL-2025-189143 Malicious code in rehype-janus-nebula-quito (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b030dfe78269f05856c1d36dcfb4812704739de10c5ef8312af45bf99110f18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...