Cross-Site Scripting in markdown-to-jsx

HIGHGHSA-ccrp-c664-8p4j · Published 03/09/2020 · updated 29/09/2021

In short

GHSA-ccrp-c664-8p4j is a HIGH vulnerability affecting markdown-to-jsx.
Fix: update to 6.11.4 or later.

Package	Affected versions	Patched versions
markdown-to-jsx npm	`< 6.11.4`	`6.11.4`

Description

Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encoded payload.

Recommendation

Upgrade to version 6.11.4 or later.

References

probablyup/markdown-to-jsx#307 · WEB
probablyup/markdown-to-jsx · PACKAGE
npmjs.com/advisories/1219 · WEB

More vulnerabilities in markdown-to-jsx

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free