XSS with Markdown rendering

High

haraldschilly published GHSA-8w44-hggw-p5rf

May 28, 2024

Package

No package listed

Affected versions

< 419862a9c9879c

Patched versions

>= 419862a9c9879c

Description

Summary

Markdown allows <script> tags that execute when published.

PoC

markdown file:

<script>alert(1)</script>

publish the file.

example poc:
https://cocalc.com/share/public_paths/cce1c32004d0605bb8b6e84cdc83cb9b6eb99eaf

Severity

High

7.6

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L