npm/marky-markdown · Security
HTML Injection in marky-markdown
- GHSA ID
- GHSA-mg69-6j3m-jvgw
- Severity
- high
- Published
- Updated
- CVSS
- 7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CVSS v3
- 7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Description
All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML.
Recommendation
This package is no longer maintained. Please upgrade to @npmcorp/marky-markdown
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')