234 matches found
GHSA-VCCX-P757-PV6H mo has a XSS via inline SVG script tags in Markdown rendering
Summary When rendering Markdown files containing inline SVG elements with tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML including SVG through to the DOM without sanitization. PoC html alert1 Embedding the above in a Markdown file opened with ...
CVE-2026-28509
LangBot’s web UI prior to version 4.8.7 renders user-supplied raw HTML via rehypeRaw, resulting in a cross-site scripting (XSS) vulnerability. Affected product: LangBot (global IM bot platform for LLMs). Root cause: unescaped user HTML processed by rehypeRaw. Impact (per CVSS): Confidentiality im...
CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...
CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...
CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...
LangBot 跨站脚本漏洞
LangBot is an open-source development platform for large-scale instant messaging robots created by LangBot. Versions of LangBot prior to 4.8.7 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of rehypeRaw to render the original HTML provided by users, which...
Malicious code in gemini-postgres-rehype-sagitta (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835234f600dc962131b0c036e7163ad52a55b2eff7514f87441427dbc9a88dae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179427
Malicious code in cz-conventional-changelog-ora-rehype-xanadu npm...
EUVD-2025-175799
Malicious code in update-hadron-rehype-phoenix npm...
Malicious code in ignite-rehype-xo-cypress (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4a51f0740e1612c51322e453536c8292d2bc79861076bc5c2b152821856564f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in grus-nodemon-rehype-hermes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6d559410a1d7d46410b0043f04df13062a94d3ab8a1f955226d05167489046f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in cosmiconfig-xml-rehype-webpack (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c337d51a5afe782ff83bde8f55685686a71e8d4b23d52af00c64f247b76db8e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-187244 Malicious code in grus-nodemon-rehype-hermes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6d559410a1d7d46410b0043f04df13062a94d3ab8a1f955226d05167489046f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178452
Malicious code in ignite-rehype-xo-cypress npm...
EUVD-2025-179465
Malicious code in css-loader-rehype-toml-version npm...
EUVD-2025-178740
Malicious code in gemini-postgres-rehype-sagitta npm...
EUVD-2025-178466
Malicious code in hyperion-prettier-stylelint-sqlite-rehype npm...
EUVD-2025-178638
Malicious code in grus-nodemon-rehype-hermes npm...