CVE-2020-7773: Cross-site Scripting in markdown-it-highlightjs
Summary
CVE-2020-7773: Cross-site Scripting in markdown-it-highlightjs. Affects markdown-it-highlightjs versions < 3.3.1. Fixed in 3.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
markdown-it-highlightjs is an npm package that provides inline code highlighting for Markdown documents. It is commonly used in web applications to render code snippets with syntax highlighting. The package integrates with markdown-it, a popular Markdown parser. However, versions before 3.3.1 of markdown-it-highlightjs are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in markdown-it-highlightjs allows an attacker to inject malicious JavaScript code by exploiting the Inline code highlighting feature. By providing a specially crafted value for the 'lang' parameter, an attacker can execute arbitrary code in the context of the user's browser. This can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and defacement of the affected web application.
How To Fix
Latest published version: 4.3.0 as of 22 Oct 2026
npm install markdown-it-highlightjs@4.3.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.1
This is the first release that contains the fix.
npm install markdown-it-highlightjs@3.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the inline code highlighting feature in markdown-it-highlightjs. This can be done by setting the 'inline' option to 'false' when configuring the markdown-it-highlightjs plugin. However, this workaround may impact the visual presentation of code snippets in the rendered Markdown.
Conclusion
The vulnerability in markdown-it-highlightjs allows for cross-site scripting attacks, potentially leading to unauthorized access and other security risks. It is crucial to upgrade to the latest version of markdown-it-highlightjs (3.3.1 or later) to mitigate this vulnerability. If upgrading immediately is not possible, consider applying the temporary workaround of disabling the inline code highlighting feature. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for markdown-it-highlightjs →
FAQ
markdown-it-highlightjs is an npm package that provides inline code highlighting for Markdown documents. It integrates with markdown-it, a popular Markdown parser.
The vulnerability allows an attacker to execute arbitrary JavaScript code in the user's browser, potentially leading to unauthorized access, session hijacking, and defacement of the affected web application.
To fix this vulnerability, upgrade to version 3.3.1 or later of markdown-it-highlightjs. Ensure that your application's dependencies are updated to use the latest version.
Yes, you can temporarily disable the inline code highlighting feature in markdown-it-highlightjs by setting the 'inline' option to 'false' when configuring the plugin. However, this may affect the visual presentation of code snippets in the rendered Markdown.
You can find more information about this vulnerability in the GitHub Advisory Database. Additionally, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
