| Package | Affected versions | Patched versions |
|---|---|---|
| marked | ≤ 0.3.2 | |
| marked | < 0.3.3 | 0.3.3 |
Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.
[xss link](vbscript:alert(1))
will get a link
<a href="vbscript:alert(1)">xss link</a>
Update to version 0.3.3 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free