GitHub Advisoryadvisory · npm

GHSA-mg69-6j3m-jvgw HTML Injection in marky-markdown

HIGH Published 2020-09-03 Modified 2021-10-04 Official page ↗
Ecosystem
npm
Packages
marky-markdown
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm marky-markdown: >= 0.0.0 (no fix yet)

Description

All versions of `marky-markdown` are vulnerable to HTML Injection. The package fails to sanitize `style` attributes in `img` tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. Recommendation This package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References