Valine HTML Injection

中危 6.1CVE-2018-19289 · GHSA-hhrp-qm88-xjr3 · Published 15/11/2018 · updated 17/06/2026

要点

CVE-2018-19289 是影响 valine (valine.js), valine 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：1.2%，高于 68.9% 的漏洞。
修复：升级到 1.3.4 或更高版本。

Package	Affected versions	Patched versions
valine valine.js	`= 1.3.3`	No fix yet
valine npm	`< 1.3.4`	`1.3.4`

Description

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.

NVD description

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.

References

nvd.nist.gov/vuln/detail/CVE-2018-19289 · ADVISORY
xCss/Valine · WEB
xCss/Valine commit 32d4d5e · WEB
GitHub Advisory GHSA-hhrp-qm88-xjr3 · ADVISORY
xCss/Valine · PACKAGE

valine 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

valine

valine.js

= 1.3.3

No fix yet

valine

npm

< 1.3.4

1.3.4

Description

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.

NVD description

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.

valine 的其他漏洞

查看全部 →