SimpleMDE XSS Vulnerability

中危 6.1CVE-2018-19057 · GHSA-wg85-p6j7-gp3w · Published 07/11/2018 · updated 17/06/2026

要点

CVE-2018-19057 是影响 simplemde (sparksuite), simplemde 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.79%，高于 56.4% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
simplemde sparksuite	`= 1.11.2`	No fix yet
simplemde npm	`≤ 1.11.2`	No fix yet

Description

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.

NVD description

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.

References

nvd.nist.gov/vuln/detail/CVE-2018-19057 · ADVISORY
sparksuite/simplemde-markdown-editor · WEB
GitHub Advisory GHSA-wg85-p6j7-gp3w · ADVISORY
sparksuite/simplemde-markdown-editor · PACKAGE

simplemde 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free