Skip to content

Cross-Site Scripting in simple-markdown

Moderate severity GitHub Reviewed Published Apr 9, 2019 • Updated Sep 16, 2021

Package

npm simple-markdown (npm)

Affected versions

< 0.4.4

Patched versions

0.4.4

Description

Versions of simple-markdown prior to 0.4.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encoded payload.

Recommendation

Upgrade to version 0.4.4 or later.

References

Severity

Moderate
6.1
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CVE ID

CVE-2019-9844

GHSA ID

GHSA-qj3f-9gmq-fwv5

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.