Skip to content

Markdown injection #2

@nijel

Description

@nijel

Reported by Emanuel Bronshtein:

Markdown injection
in:
https://github.com/phpmyadmin/scripts/blob/master/phpmyadmin-reports#L144
https://github.com/phpmyadmin/scripts/blob/master/phpmyadmin-reports#L144
commit message & issue title are inserted into markdown link text context without escaping.
sample injection:
A](https://phishing.com) [t

fix:
escape needed chars:
\ ]
in order to avoid the injection.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions