Content Injection Affecting remarkable package, versions <1.4.1
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.09% (38th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:remarkable:20141113
- published 13 Nov 2014
- disclosed 13 Nov 2014
- credit Adam Baldwin
Introduced: 13 Nov 2014
CVE-2014-10065 Open this link in a new tabHow to fix?
Upgrade remarkable to version 1.4.1 or higher.
Overview
remarkable is a markdown parsing library written in Javascript.
Affected versions of this package are vulnerable to Content Injection. Certain input when passed into remarkable will bypass the bad prototcol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.
Details
Example:
[link](<javascript:alert(1)>)
This will be turned into <a href="javascript:alert(1)">link</a>
where as
[link](javascript:alert(1))
Would be rendered as [link](javascript:alert(1)) because it's an invalid scheme.