GHSA-m7qm-r2r5-f77q Cross-Site Scripting in react-marked-markdown
Cross-site scripting vulnerability in react-marked-markdown allows attackers to execute arbitrary JavaScript via malicious href attributes in user-provided markdown content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is GHSA-m7qm-r2r5-f77q?
GHSA-m7qm-r2r5-f77q is a cross-site scripting vulnerability in react-marked-markdown, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All versions of react-marked-markdown are vulnerable to cross-site scripting (XSS) via href attributes. This is exploitable if user is provided to react-marked-markdown
Proof of concept:
import React from 'react'
import ReactDOM from 'react-dom'
import { MarkdownPreview } from 'react-marked-markdown'
ReactDOM.render(
<MarkdownPreview
markedOptions={{ sanitize: true }}
value={'[XSS](javascript: alert`1`)'}
/>,
document.getElementById('root')
)
Recommendation
No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time if you allow user input into href values.
Which versions are affected by GHSA-m7qm-r2r5-f77q?
2 open source packages ship an affected version, including react-marked-markdown.
| Package | Affected | Fixed in |
|---|---|---|
react-marked-markdown npm | From 0.0.0 | None |
react-marked-markdown npm | From 0.0.0 | None |
How do I fix GHSA-m7qm-r2r5-f77q?
No fix has been published for GHSA-m7qm-r2r5-f77q yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-m7qm-r2r5-f77q being exploited?
There is no known exploitation of GHSA-m7qm-r2r5-f77q in the wild and no public exploit code.