CVE-2019-10905 Parsedown Class-Name Injection
Attackers can execute arbitrary JavaScript via crafted Markdown when safe mode is enabled and HTML is disabled, affecting applications using Parsedown.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10905?
CVE-2019-10905 is a high-severity cross-site scripting vulnerability in n/a, published on 6 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, which interferes with the intended behavior of a single class name beginning with the language- substring.
Weakness: CWE-79
Which versions are affected by CVE-2019-10905?
2 open source packages ship an affected version, including erusev/parsedown. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
erusev/parsedown Packagist | All versions | 1.7.2 |
erusev/parsedown Packagist | All versions | 1.7.2 |
Products include Parsedown Parsedown.
How do I fix CVE-2019-10905?
Upgrade erusev/parsedown to 1.7.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-10905 being exploited?
There is no known exploitation of CVE-2019-10905 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-62m3-fc7f-jpp8.