Description
All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co. This
Recommendation
No fix is available yet. Followings are affected versions:
- >= 0.0.0
References
Could your website be exposed too?
SmartScanner can check your website for HTML Injection in marky-markdown and gives you actionable findings to investigate.
Start a free scanRelated Issues
- HTML Injection in marky-markdown - marky-markdown - Vulnerability
- HTML tag injection - Vulnerability
- XSS/HTML Injection Vulnerability in Umbraco Backoffice Components - CVE-2025-24012
- Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023