heyitsmeuralex/mrk · Security
Cross-Site Scripting in mrk.js
- GHSA ID
- GHSA-hpr5-wp7c-hh5q
- Severity
- high
- Published
- Updated
Description
Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.
Recommendation
Update to version 2.0.1 or later and use mark.sanitizeURL() for any src and href attributes when extending the markdown.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')