Cross-Site Scripting (XSS) Vulnerability in node-marked
Summary
CVE-2015-1370: Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link. Affects node-marked versions < 0.3.6+dfsg-1. Fixed in 0.3.6+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-marked is a package for Node.js that allows for the parsing and rendering of Markdown documents. It is commonly used in web applications to convert Markdown content into HTML. However, versions 0.3.2 and earlier of node-marked are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability (CVE-2015-1370) arises from an incomplete blacklist in node-marked, which allows remote attackers to execute arbitrary JavaScript code in the context of a victim's browser. This can be achieved by injecting a vbscript tag in a link. The impact of this vulnerability is that an attacker can perform actions on behalf of the victim, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Minimum fixed version
0.3.6+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating node-marked is not immediately feasible, a temporary workaround is to sanitize user input before rendering it with node-marked. This can be done by using a library like DOMPurify to remove any potentially malicious code from the input.
Conclusion
In conclusion, the cross-site scripting (XSS) vulnerability in node-marked (CVE-2015-1370) allows remote attackers to execute arbitrary JavaScript code in the context of a victim's browser. It is crucial to update node-marked to the latest version or sanitize user input to mitigate the risk of this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-marked →
FAQ
node-marked is a package for Node.js that allows for the parsing and rendering of Markdown documents.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The vulnerability in node-marked arises from an incomplete blacklist, which allows attackers to inject arbitrary JavaScript code in the context of a victim's browser.
The consequences of this vulnerability include unauthorized access, data theft, and the ability to perform actions on behalf of the victim.
To protect your application, it is recommended to update node-marked to the latest version or sanitize user input before rendering it with node-marked.
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
