GitHub Advisoryadvisory · npm

GHSA-pxmp-fwjc-4x7q HTML Injection in marky-markdown

MEDIUM Published 2020-09-03 Modified 2021-10-04 Official page ↗
Ecosystem
npm
Packages
marky-markdown
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm marky-markdown: >= 0.0.0 (no fix yet)

Description

All versions of `marky-markdown` are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is `youtube.com` but it is possible to bypass the validation with sources where `youtube.com` is the sub-domain, such as `youtube.com.evil.co`. This Recommendation This package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References