CVE-2017-1000491: Shiba Markdown Live Preview App XSS Code Execution
Summary
CVE-2017-1000491: Shiba vulnerable to XSS leading to code execution. Affects shiba versions < 1.1.1. Fixed in 1.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shiba is a markdown live preview app that provides users with the ability to preview their markdown files in real-time. It is an npm package that enables node integration. Shiba version 1.1.0 is vulnerable to a cross-site scripting (XSS) attack, which can lead to code execution.
Vulnerability Detail
The vulnerability in Shiba version 1.1.0 is due to the enabled node integration, which allows an attacker to inject malicious code through a crafted XSS payload. This can result in the execution of arbitrary code within the context of the application, potentially leading to further compromise of the system. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
How To Fix
Latest published version: 1.2.1 as of 23 Oct 2026
npm install shiba@1.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.1
This is the first release that contains the fix.
npm install shiba@1.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update to the latest version of Shiba to mitigate the risk.
Conclusion
Shiba version 1.1.0 is vulnerable to an XSS attack that can lead to code execution. It is crucial to update to version 1.1.1 or later to mitigate this vulnerability. For more assistance and guidance, reach out to DevNack.com.
See every vulnerability recorded for shiba →
FAQ
The vulnerability allows an attacker to execute arbitrary code within the context of the Shiba application, potentially leading to further compromise of the system.
There is no known exploit available for this vulnerability at the moment.
No, only Shiba version 1.1.0 is affected. Versions 1.1.1 and later have addressed the vulnerability.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity.
For further information and support on vulnerability remediation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for shiba.
