Описание
Content Injection in remarkable
Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly whitelist link protocols, and consequently allowed javascript: to be used.
Proof of Concept
Markdown Source:
[link](<javascript:alert(1)>)
Rendered HTML:
<a href="javascript:alert(1)">link</a>
Recommendation
Update to version 1.4.1 or later
Пакеты
Наименование
remarkable
npm
Затронутые версииВерсия исправления
< 1.4.1
1.4.1
Связанные уязвимости
CVSS3: 6.1
nvd
больше 7 лет назад
Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.