HTML Injection in marky-markdown - marky-markdown

Description

All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0.0.0

References

• GHSA-mg69-6j3m-jvgw
• www.npmjs.com
• snyk.io
• CWE-79
• OWASP 2021-A3

Related Issues

• HTML Injection in marky-markdown - Vulnerability
• HTML tag injection - Vulnerability
• XSS/HTML Injection Vulnerability in Umbraco Backoffice Components - CVE-2025-24012
• HTML Injection in preact - Vulnerability

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Update Cheat Sheet for Developers

Tags:

npm

marky-markdown