GitHub Advisoryadvisory · npm
GHSA-f9vc-q3hh-qhfv Content Injection in remarkable
HIGH
Official page ↗
- Aliases
- CVE-2014-10065
- Ecosystem
- npm
- Packages
- remarkable
- Severity
- High
- Weaknesses
- CWE-94
- Reviewed
- 2020-08-31
Affected packages
• npm remarkable: < 1.4.1 → fixed in 1.4.1
Description
Versions 1.4.0 and earlier of `remarkable` are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of `remarkable` did not properly whitelist link protocols, and consequently allowed `javascript:` to be used.
Proof of Concept
Markdown Source:
```
link>)
```
Rendered HTML:
```
link
```
Recommendation
Update to version 1.4.1 or later
Related
Alias · CVE (1)
- CVE-2014-10065 Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing… vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness