CVE-2023-22491 gatsby-transformer-remark vulnerable to unsanitized JavaScript code injection

Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default...

CVE-2023-22491

The CVE-2023-22491 entry concerns the Gatsby gatsby-transformer-remark plugin, affected in versions prior to 5.25.1 and 6.3.2. The vulnerability arises when the plugin passes input to gray-matter in data mode, allowing JavaScript injection in its default configuration if input is not sanitized; i...

CVE-2023-22491

Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default...

10secondsofcode-custom (=1.0.0), 1kohei1 (>=1.0.0 <=1.0.1) +442 more potentially affected by CVE-2023-22491 via gatsby-transformer-remark (>=1.7.37 <=5.23.1)

gatsby-transformer-remark NPM version =1.7.37, =1.0.0, =1.0.0, =3.0.0, =1.0.0, =0.1.1, =0.1.0, =1.0.0, =0.13.2, =4.0.0-4.0.0-alpha.3.0, =0.1.0, =1.1.18-beta.1 and more Source cves: CVE-2023-22491 Source advisory: OSV:GHSA-7CH4-RR99-CQCW...

@adobe/gatsby-theme-aio (=5.0.0-rc2), @boomerang-io/gatsby-theme-boomerang (>=1.5.0 <=1.6.9) +22 more potentially affected by CVE-2023-22491 via gatsby-transformer-remark (>=6.0.0 <=6.16.0)

gatsby-transformer-remark NPM version =6.0.0, =1.5.0, =1.0.42, =0.3.0, =0.0.18, =1.0.1, =1.0.0, =1.0.0, =1.0.7, =1.0.0, =1.0.2, =0.1.0, =0.1.0, =1.0.0, =4.5.0 and more Source cves: CVE-2023-22491 Source advisory: OSV:GHSA-7CH4-RR99-CQCW...

GHSA-7CH4-RR99-CQCW gatsby-transformer-remark has possible unsanitized JavaScript code injection

Impact The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when...

gatsby-transformer-remark has possible unsanitized JavaScript code injection

Impact The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when...

CVE-2022-45720

IP-COM M50 V15.11.0.3310768 was discovered to contain multiple buffer overflows via the ip, mac, and remark parameters in the formIPMacBindModify function...

CVE-2022-45720

IP-COM M50 V15.11.0.3310768 was discovered to contain multiple buffer overflows via the ip, mac, and remark parameters in the formIPMacBindModify function...

PT-2022-27634 · Ip Com · Ip-Com M50

Name of the Vulnerable Software and Affected Versions: IP-COM M50 version 15.11.0.3310768 Description: The issue is related to multiple buffer overflows that can occur via the ip, mac, and remark parameters in the formIPMacBindModify function. Recommendations: For IP-COM M50 version...

CVE-2022-44296

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manageremark.php?id=...

Apartment Visitor Management System SQL注入漏洞

Apartment Visitor Management System is an Apartment Visitor Management System by Carlo Montero Personal Developer. Apartment Visitor Management System suffers from a SQL injection vulnerability that stems from some unknown functionality in the file action-visitor.php being affected, where...

Malicious code in gatsby-remark-gifplayer-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a24f738254038f89f0dfffb77eac814848c029453d9187c76e9bb34ced3110e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3284 Malicious code in gatsby-remark-gifplayer-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a24f738254038f89f0dfffb77eac814848c029453d9187c76e9bb34ced3110e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-9Q5W-79CV-947M Unsafe defaults in `remark-html`

Impact The documentation of remark-html has mentioned that it was safe by default. In practise the default was never safe and had to be opted into. This means arbitrary HTML can be passed through leading to potential XSS attacks. Patches The problem has been patched in 13.0.2 and 14.0.1:...

@anemone/newline-use-comments (=3.0.0), @artur0prets/parcel-transformer-remark (=0.0.3) +100 more potentially affected by CVE-2021-39199 via remark-html (>=10.0.0 <=13.0.1)

remark-html NPM version =10.0.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =1.0.0, =0.0.2-15, =0.0.2-15, =0.0.2-15, =0.0.2-15, =0.0.2-15, =0.0.2-15, =0.0.2-15, =0.0.2-18 and more Source cves: CVE-2021-39199 Source advisory: OSV:GHSA-9Q5W-79CV-947M...

Unsafe defaults in `remark-html`

Impact The documentation of remark-html has mentioned that it was safe by default. In practise the default was never safe and had to be opted into. This means arbitrary HTML can be passed through leading to potential XSS attacks. Patches The problem has been patched in 13.0.2 and 14.0.1:...

CVE-2021-39199

remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitra...

CVE-2021-39199

remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitra...

Design/Logic Flaw

remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitra...