Description
Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as Click Me is rendered as a Click Me link that executes JavaScript.
Recommendation
Update the ngx-md package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.0.3
- Patched version(s): 6.0.3
References
Related Issues
- jsPDF Denial of Service (DoS) - CVE-2025-57810
- MailDev Remote Code Execution - CVE-2024-27448
- vxe-table prototype pollution - CVE-2024-57080
- Cross-Site Scripting in jquery - CVE-2020-7656
- Tags:
- npm
- ngx-md
Anything's wrong? Let us know Last updated on January 09, 2023