GitHub Advisoryadvisory · Packagist

GHSA-qgpv-86r3-87fh Cross-site Scripting in Parsedown

MEDIUM Published 2022-03-30 Modified 2022-03-30 Official page ↗
Aliases
CVE-2018-1000162
Ecosystem
Packagist
Packages
erusev/parsedown
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-03-30

Affected packages

• Packagist erusev/parsedown: < 1.7.0 → fixed in 1.7.0

Description

Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.

Related

Alias · CVE (1)

  • CVE-2018-1000162 Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References