GitHub Advisoryadvisory · npm
GHSA-mrmf-qwxg-7c3h XSS in Data URI in remarkable
HIGH
Official page ↗
- Aliases
- CVE-2017-16006
- Ecosystem
- npm
- Packages
- remarkable
- Severity
- High
- Weaknesses
- CWE-79
- Reviewed
- 2020-06-16
Affected packages
• npm remarkable: < 1.7.0 → fixed in 1.7.0
Description
Affected versions of `remarkable` are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of `data:` URIs in links, and can therefore execute javascript.
Proof of Concept
```markdown
link)
```
Recommendation
Update to v1.7.0 or later
Related
Alias · CVE (1)
- CVE-2017-16006 Remarkable is a markdown parser. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness