CVE-2021-39199 Cross site scripting via unsafe defaults in remark-html
Attackers can inject arbitrary HTML leading to XSS because remark-html did not sanitize user input by default despite documentation claims.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-39199?
CVE-2021-39199 is a critical cross-site scripting vulnerability in remarkjs remark-html, published on 7 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitrary HTML can be passed through leading to potential XSS attacks. The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation. On older affected versions, pass `sanitize: true` if you cannot update.
Weakness: CWE-79
Which versions are affected by CVE-2021-39199?
4 open source packages ship an affected version, including remark-html. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
remark-html npm | All versions | 13.0.2 |
remark-html npm | All versions | 13.0.2 |
remark-html npm | From 14.0.0 | 14.0.1 |
remark-html npm | From 14.0.0 | 14.0.1 |
Products include Remark Remark-Html.
How do I fix CVE-2021-39199?
Upgrade remark-html to a fixed version for your release line: 13.0.2 or 14.0.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-39199 being exploited?
There is no known exploitation of CVE-2021-39199 in the wild and no public exploit code.
Sources
Also known as GHSA-9q5w-79cv-947m.