GHSA-pxmp-fwjc-4x7q HTML Injection in marky-markdown
Attacker can inject malicious HTML via bypassed iframe validation, leading to potential code execution in user browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is GHSA-pxmp-fwjc-4x7q?
GHSA-pxmp-fwjc-4x7q is a cross-site scripting vulnerability in marky-markdown, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co. This
Recommendation
This package is no longer maintained. Please upgrade to @npmcorp/marky-markdown
Which versions are affected by GHSA-pxmp-fwjc-4x7q?
2 open source packages ship an affected version, including marky-markdown.
| Package | Affected | Fixed in |
|---|---|---|
marky-markdown npm | From 0.0.0 | None |
marky-markdown npm | From 0.0.0 | None |
How do I fix GHSA-pxmp-fwjc-4x7q?
No fix has been published for GHSA-pxmp-fwjc-4x7q yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-pxmp-fwjc-4x7q being exploited?
There is no known exploitation of GHSA-pxmp-fwjc-4x7q in the wild and no public exploit code.