markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped

Description

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.0

References

• GHSA-wfvx-fx73-3rfj
• security.snyk.io
• CVE-2020-28455
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript - CVE-2019-16763
• Cross-site Scripting in markdown-it-highlightjs - CVE-2020-7773
• Cross site scripting in valine - CVE-2020-28847
• Cross-site scripting in Joplin - joplin - CVE-2020-28249

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

markdown-it-toc