GHSA-hpr5-wp7c-hh5q Cross-Site Scripting in mrk.js
An attacker can inject malicious scripts via markdown conversion in mrk.js, potentially executing code in the victim's browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-hpr5-wp7c-hh5q?
GHSA-hpr5-wp7c-hh5q is a cross-site scripting vulnerability in mrk.js, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.
Recommendation
Update to version 2.0.1 or later and use mark.sanitizeURL() for any src and href attributes when extending the markdown.
Which versions are affected by GHSA-hpr5-wp7c-hh5q?
2 open source packages ship an affected version, including mrk.js.
| Package | Affected | Fixed in |
|---|---|---|
mrk.js npm | All versions | 2.0.1 |
mrk.js npm | All versions | 2.0.1 |
How do I fix GHSA-hpr5-wp7c-hh5q?
Upgrade mrk.js to 2.0.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-hpr5-wp7c-hh5q being exploited?
There is no known exploitation of GHSA-hpr5-wp7c-hh5q in the wild and no public exploit code.