Cross-Site Scripting in markdown-to-jsx (GHSA-ccrp-c664-8p4j)

Description

Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encoded payload.

Recommendation

Update the markdown-to-jsx package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.11.4
• Patched version(s): 6.11.4

References

• GHSA-ccrp-c664-8p4j
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• Cross site scripting in markdown-to-jsx - CVE-2024-21535
• Cross-Site Scripting in swagger-ui (GHSA-4f9m-pxwh-68hg) - Vulnerability
• Bootstrap Cross-site Scripting vulnerability (GHSA-7mvr-5x2g-wfc8) 2 - CVE-2018-14042
• Cross-Site Scripting in swagger-ui (GHSA-388g-jwpg-x6j4) - Vulnerability

Tags:

npm

markdown-to-jsx