Content Injection in remarkable

Description

Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly whitelist link protocols, and consequently allowed javascript: to be used.

Recommendation

Update the remarkable package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.4.1
• Patched version(s): 1.4.1

References

• GHSA-f9vc-q3hh-qhfv
• www.npmjs.com
• CVE-2014-10065
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Multiple Content Injection Vulnerabilities in marked - CVE-2014-3743
• Content Injection via TileJSON attribute in mapbox.js - CVE-2017-1000042
• Content Injection via TileJSON Name in mapbox.js - CVE-2017-1000043
• Denial of Service and Content Injection in i18n-node-angular - CVE-2016-10524

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

remarkable