discord-html not escaping HTML code blocks when lacking a language identifier
- Severity:
- High
Description
Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.
Recommendation
Update the discord-markdown package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.3.1
- Patched version(s): 2.3.1
References
Related Issues
- Regular Expression Denial of Service (ReDoS) in lodash (GHSA-29mw-wpgm-hmr9) - CVE-2020-28500
- CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - CVE-2025-58064
- Payload's SQLite adapter Session Fixation vulnerability (GHSA-26rv-h2hf-3fw4) - CVE-2025-4644
- http-proxy-middleware can call writeBody twice because "else if" is not used - CVE-2025-32996
- Tags:
- npm
- discord-markdown
Anything's wrong? Let us know Last updated on January 09, 2023