-
Notifications
You must be signed in to change notification settings - Fork 18
Closed
Description
Reported by Emanuel Bronshtein:
Markdown injection
in:
https://github.com/phpmyadmin/scripts/blob/master/phpmyadmin-reports#L144
https://github.com/phpmyadmin/scripts/blob/master/phpmyadmin-reports#L144
commit message & issue title are inserted into markdown link text context without escaping.
sample injection:
A](https://phishing.com) [t
fix:
escape needed chars:
\ ]
in order to avoid the injection.
Metadata
Metadata
Assignees
Labels
No labels