CVE-2024-21535: Cross-site Scripting Vulnerability in markdown-to-jsx
Summary
CVE-2024-21535: Cross site scripting in markdown-to-jsx. Affects markdown-to-jsx versions < 7.4.0. Fixed in 7.4.0. How to fix ↓
Also tracked for
- node-markdown-to-jsx · Debian:13
The same CVE-2024-21535 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
markdown-to-jsx is a popular npm package that converts Markdown content into JSX components for use in React applications. It allows developers to easily render Markdown in their applications while maintaining the flexibility of JSX. However, versions prior to 7.4.0 are susceptible to a Cross-site Scripting (XSS) vulnerability, which can lead to serious security risks if not addressed.
Vulnerability Detail
The vulnerability arises from improper input sanitization in the markdown-to-jsx package, specifically through the src property. An attacker can exploit this flaw by injecting a malicious iframe element into the Markdown content. If rendered, this can allow the attacker to execute arbitrary code in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious activities.
How To Fix
Minimum fixed version
7.4.0
This is the first release that contains the fix.
npm install markdown-to-jsx@7.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider sanitizing the Markdown input before rendering it. You can use libraries like DOMPurify to clean the input. Here is an example of how to use DOMPurify:
import DOMPurify from 'dompurify';
const cleanMarkdown = (markdown) => {
return DOMPurify.sanitize(markdown);
};
const safeHtml = cleanMarkdown(yourMarkdownContent);
Conclusion
The markdown-to-jsx package has a critical vulnerability that can lead to XSS attacks if not addressed. It is essential for developers using this package to update to version 7.4.0 or later to mitigate the risk. Additionally, implementing input sanitization can provide an extra layer of security until the update can be applied.
See every vulnerability recorded for markdown-to-jsx →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user data and security.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
Exploitation of this vulnerability can lead to unauthorized access to user data, session hijacking, and execution of arbitrary code in the user's browser.
Yes, you can sanitize the Markdown input using libraries like DOMPurify to prevent the execution of malicious scripts.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for markdown-to-jsx.
