Markdown-Nice v1.8.22 vulnerable to Cross-site Scripting

MÉDIO 5.4CVE-2022-38639 · GHSA-462r-wxvm-jvxh · Published 09/09/2022 · updated 17/06/2026

Em resumo

CVE-2022-38639 é uma vulnerabilidade MÉDIO (CVSS 5.4) que afeta markdown nice (inkdrop), markdown-nice.
Chance de exploração nos próximos 30 dias (EPSS): 0.51%, maior que 43.5% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
markdown nice inkdrop	`= 1.8.22`	No fix yet
markdown-nice npm	`≤ 1.8.22`	No fix yet

Description

A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field.

NVD description

A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field.

References

nvd.nist.gov/vuln/detail/CVE-2022-38639 · ADVISORY
mdnice/markdown-nice · WEB
mdnice/markdown-nice · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free