Cross-Site Scripting in editor.md

MEDIO 6.1CVE-2019-9737 · GHSA-2j5v-fc74-j9q2 · Published 13/03/2019 · updated 17/06/2026

En resumen

CVE-2019-9737 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a editor.md (ipandao), editor.md.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.86%, mayor que el 58.6% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
editor.md ipandao	`= 1.5.0`	No fix yet
editor.md npm	`= 1.5.0`	No fix yet

Description

All versions of editor.md are vulnerable to Cross-Site Scripting. User input is insufficiently sanitized, allowing attackers to inject malicious code in payloads containing base64-encoded content.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

NVD description

Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.

References

nvd.nist.gov/vuln/detail/CVE-2019-9737 · ADVISORY
pandao/editor.md · WEB
GitHub Advisory GHSA-2j5v-fc74-j9q2 · ADVISORY
npmjs.com/advisories/794 · WEB

Más vulnerabilidades de editor.md

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

editor.md

ipandao

= 1.5.0

No fix yet

editor.md

npm

= 1.5.0

No fix yet

Description

All versions of editor.md are vulnerable to Cross-Site Scripting. User input is insufficiently sanitized, allowing attackers to inject malicious code in payloads containing base64-encoded content.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

NVD description

Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.

Más vulnerabilidades de editor.md

Ver todo →