HTML Injection in marky-markdown

Description

All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co. This

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0.0.0

References

• GHSA-pxmp-fwjc-4x7q
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• HTML Injection in marky-markdown - marky-markdown - Vulnerability
• HTML tag injection - Vulnerability
• XSS/HTML Injection Vulnerability in Umbraco Backoffice Components - CVE-2025-24012
• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Update Cheat Sheet for Developers

Tags:

npm

marky-markdown