discord-html not escaping HTML code blocks when lacking a language identifier

Description

Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.

Recommendation

Update the discord-markdown package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.1
• Patched version(s): 2.3.1

References

• GHSA-9r27-994c-4xch

Related Issues

• @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plug - Vulnerability
• Vega vulnerable to arbitrary code execution when clicking href links - Vulnerability
• Svelte has a potential mXSS vulnerability due to improper HTML escaping - CVE-2024-45047
• html inputs of type password recorded in plaintext when converted to text inputs - CVE-2023-33187

Tags:

npm

discord-markdown