GitHub Advisoryadvisory · npm

GHSA-cfjh-p3g4-3q2f VBScript Content Injection in marked

MEDIUM Published 2017-10-24 Modified 2021-09-09 Official page ↗
Aliases
CVE-2015-1370
Ecosystem
npm
Packages
marked
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm marked: < 0.3.3 → fixed in 0.3.3

Description

Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set. Proof of Concept ( IE10 Compatibility Mode Only ) `xss link` will get a link `xss link` Recommendation Update to version 0.3.3 or later.

Related

Alias · CVE (1)

  • CVE-2015-1370 Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS)… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References