Cross-Site Scripting in markdown-to-jsx (GHSA-ccrp-c664-8p4j)

Description

Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encoded payload.

Recommendation

Update the markdown-to-jsx package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.11.4
• Patched version(s): 6.11.4

References

• GHSA-ccrp-c664-8p4j
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• @digitalocean/do-markdownit has Type Confusion vulnerability - CVE-2025-59717
• node-opcua-alarm-condition prototype pollution vulnerability - CVE-2024-57086
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• axios Inefficient Regular Expression Complexity vulnerability - CVE-2021-3749

Tags:

npm

markdown-to-jsx