Cross-site Scripting in markdown-it-highlightjs

Description

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature.

Recommendation

Update the markdown-it-highlightjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.3.1
• Patched version(s): 3.3.1

References

• GHSA-f246-xrrj-g8j6
• snyk.io
• CVE-2020-7773
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped - CVE-2020-28455
• Cross-site Scripting (XSS) in Eclipse Theia - CVE-2020-27224
• Cross-site scripting in SocksJS-node - CVE-2020-8823
• Cross site scripting in markdown-to-jsx - CVE-2024-21535

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

markdown-it-highlightjs