| Package | Affected versions | Patched versions |
|---|---|---|
| remarkable | < 1.4.1 | 1.4.1 |
| remarkable | < 1.4.1 | 1.4.1 |
Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly whitelist link protocols, and consequently allowed javascript: to be used.
Markdown Source:
[link](<javascript:alert(1)>)
Rendered HTML:
<a href="javascript:alert(1)">link</a>
Update to version 1.4.1 or later
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free