Description
Anonymous GitHub fetches repository content (e.g., markdown files) from GitHub’s API and renders it without sanitization. On the client side, markdown is parsed with marked (with sanitize: false) and injected into the DOM via $sce.trustAsHtml() + ng-bind-html, bypassing AngularJS’s built-in XSS protection.
Recommendation
Update the @tdurieux/anonymous_github package to the latest compatible version. Followings are version details:
- Affected version(s): = 2.2.0
- Patched version(s): 2.3.0
References
Could your website be exposed too?
SmartScanner can check your website for @tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Ori and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - Vulnerability
- Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - @excalidraw/mermaid-to-excalidraw - Vulnerability
- auth0-lock vulnerable to XSS via unsanitized placeholder property - CVE-2019-20174
- PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated May 05, 2026