GitHub Advisoryadvisory · npm

GHSA-hpr5-wp7c-hh5q Cross-Site Scripting in mrk.js

HIGH Published 2020-09-01 Modified 2021-09-23 Official page ↗
Ecosystem
npm
Packages
mrk.js
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm mrk.js: < 2.0.1 → fixed in 2.0.1

Description

Versions of `mrk.js` before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML. Recommendation Update to version 2.0.1 or later and use `mark.sanitizeURL()` for any `src` and `href` attributes when extending the markdown.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References