CVE-2019-12043: Cross-site Scripting in remarkable
Summary
CVE-2019-12043: Cross-site Scripting in remarkable. Affects remarkable versions < 1.7.2. Fixed in 1.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'remarkable' package is an npm package used for parsing and rendering Markdown content. It provides a simple and efficient way to convert Markdown text into HTML. The package is widely used in web applications and content management systems to display user-generated content. However, version 1.7.1 of 'remarkable' is vulnerable to a cross-site scripting (XSS) attack due to mishandling of URL filtering. This vulnerability allows attackers to inject malicious scripts into the rendered HTML, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The vulnerability in 'remarkable' version 1.7.1 arises from a flaw in the 'lib/parser_inline.js' file. The package fails to properly filter URLs, allowing attackers to bypass security measures and inject unprintable characters, such as the ASCII control character '\x0e', followed by a 'javascript:' URL. This enables the execution of arbitrary JavaScript code in the context of the vulnerable application. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted webpage or clicking on a malicious link. The impact of this vulnerability can range from stealing sensitive user information to performing actions on behalf of the user within the application.
How To Fix
Latest published version: 2.0.1 as of 23 Oct 2026
npm install remarkable@2.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.2
This is the first release that contains the fix.
npm install remarkable@1.7.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually sanitizing user-generated Markdown content before passing it to the 'remarkable' parser. This can be achieved by using a library or function that sanitizes HTML input, removing any potentially malicious scripts or tags. It is important to note that this workaround is not a permanent solution and should only be considered as a temporary measure until the package is updated.
Conclusion
The 'remarkable' package version 1.7.1 is vulnerable to a cross-site scripting (XSS) attack due to improper URL filtering. This can allow attackers to inject malicious scripts into the rendered HTML, potentially leading to unauthorized access or data theft. To mitigate this vulnerability, it is recommended to upgrade to version 1.7.2 or later. In the meantime, manual sanitization of user-generated Markdown content can serve as a temporary workaround. For further assistance, contact DevNack.com.
See every vulnerability recorded for remarkable →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript code in the context of the vulnerable application. This can lead to unauthorized access, data theft, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide the package-lock.json file of your application, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
While specific exploits targeting this vulnerability may exist, there are no publicly known exploits at the time of this report. However, it is crucial to address the vulnerability promptly to prevent potential attacks.
For further support and assistance in remediating this vulnerability, you can reach out to info@devnack.com. The experts at Devnack can provide guidance and help ensure the security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for remarkable.
