discord-html not escaping HTML code blocks when lacking a language identifier

Description

Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.

Recommendation

Update the discord-markdown package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.1
• Patched version(s): 2.3.1

References

• GHSA-9r27-994c-4xch

Related Issues

• Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - CVE-2025-65944
• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-29mw-wpgm-hmr9) - CVE-2020-28500
• Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter - CVE-2025-58179
• CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - CVE-2025-58064

Tags:

npm

discord-markdown