GitHub Advisoryadvisory · npm

GHSA-xr53-m937-jr9c Cross-Site Scripting in ngx-md

HIGH Published 2020-09-03 Modified 2021-10-04 Official page ↗
Ecosystem
npm
Packages
ngx-md
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm ngx-md: < 6.0.3 → fixed in 6.0.3

Description

Versions of `ngx-md` prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as `Click Me` is rendered as a `Click Me` link that executes JavaScript. Recommendation Upgrade to version 6.0.3 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References