Content Injection

Affecting remarkable package, versions <1.4.1

Overview

remarkable is a markdown parsing library written in Javascript.

Affected versions of this package are vulnerable to Content Injection. Certain input when passed into remarkable will bypass the bad prototcol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.

Details

Example:

[link](<javascript:alert(1)>)

This will be turned into <a href="javascript:alert(1)">link</a>

where as

[link](javascript:alert(1))

Would be rendered as [link](javascript:alert(1)) because it's an invalid scheme.

Remediation

Upgrade remarkable to version 1.4.1 or higher.

References

• GitHub Issue