MediumGHSA-vfvf-mqq8-rwqcCVE-2016-10531

Sanitization bypass using HTML Entities in marked

Published 18 Feb 2019 · Updated 8 Nov 2023

Affected package

markednpm
Affected
<0.3.6
Fixed in
0.3.6
Update to the fixed version for your release line, for example:npm install marked@0.3.6

Details

Affected versions of marked are susceptible to a cross-site scripting vulnerability in link components when sanitize:true is configured.

Proof of Concept

This flaw exists because link URIs containing HTML entities get processed in an abnormal manner. Any HTML Entities get parsed on a best-effort basis and included in the resulting link, while if that parsing fails that character is omitted.

For example:

A link URI such as

javascript&#x58document;alert&#40;1&#41;

Renders a valid link that when clicked will execute alert(1).

Recommendation

Update to version 0.3.6 or later.

Is GHSA-vfvf-mqq8-rwqc in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected marked, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.