GitHub Advisoryadvisory · npm

GHSA-9r27-994c-4xch discord-html not escaping HTML code blocks when lacking a language identifier

HIGH Published 2020-02-24 Modified 2020-02-21 Official page ↗

Ecosystem: npm
Packages: discord-markdown
Severity: High
Reviewed: 2020-02-21

Affected packages

• npm discord-markdown: < 2.3.1 → fixed in 2.3.1

Description

Impact Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed. Patches This has been patched in version 2.3.1 Workarounds Escape the characters `<>&` before sending plain code blocks to discord-markdown. References https://github.com/brussell98/discord-markdown/issues/13

References

https://github.com/brussell98/discord-markdown/security/advisories/GHSA-9r27-994c-4xch web
https://github.com/brussell98/discord-markdown/issues/13 web
https://github.com/brussell98/discord-markdown/commit/7ce2eb66520815dcf5e97ef2bc8a2d5979da66e7 web