Markdown-Nice v1.8.22 vulnerable to Cross-site Scripting

中危 5.4CVE-2022-38639 · GHSA-462r-wxvm-jvxh · Published 09/09/2022 · updated 17/06/2026

要点

CVE-2022-38639 是影响 markdown nice (inkdrop), markdown-nice 的中危 (CVSS 5.4)漏洞。
未来 30 天内被利用的概率（EPSS）：0.51%，高于 43.5% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
markdown nice inkdrop	`= 1.8.22`	No fix yet
markdown-nice npm	`≤ 1.8.22`	No fix yet

Description

A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field.

NVD description

A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field.

References

nvd.nist.gov/vuln/detail/CVE-2022-38639 · ADVISORY
mdnice/markdown-nice · WEB
mdnice/markdown-nice · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free