Code Injection Vulnerability in discord-markdown
Summary
GHSA-9r27-994c-4xch: discord-html not escaping HTML code blocks when lacking a language identifier. Affects discord-markdown versions < 2.3.1. Fixed in 2.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
discord-markdown is an npm package that provides a markdown parser for Discord. It allows users to format their messages using markdown syntax. However, a vulnerability has been discovered in versions prior to 2.3.1 that allows for code injection. When user-generated markdown is displayed on a website, code can be injected into the page if the markdown contains code blocks without a language identifier.
Vulnerability Detail
The vulnerability in discord-markdown allows for code injection into websites that use user-generated markdown. This can lead to various security issues, such as executing arbitrary code or stealing sensitive information. The vulnerability has been assigned a severity rating of HIGH. It has been patched in version 2.3.1 of the package.
How To Fix
Minimum fixed version
2.3.1
This is the first release that contains the fix.
npm install discord-markdown@2.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not possible, a workaround is to escape the characters '<', '>', and '&' before sending plain code blocks to discord-markdown. This can be done using HTML entities: '<', '>', and '&'.
Conclusion
The code injection vulnerability in discord-markdown can have serious security implications for websites using user-generated markdown. It is crucial to update to version 2.3.1 or later to mitigate the risk. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for discord-markdown →
FAQ
The vulnerability allows for code injection into websites using user-generated markdown. This can lead to various security issues, such as executing arbitrary code or stealing sensitive information.
To fix the vulnerability, update discord-markdown to version 2.3.1 or later.
If updating to the latest version is not possible, you can escape the characters '<', '>', and '&' before sending plain code blocks to discord-markdown.
Yes, the vulnerability has been patched in version 2.3.1 of discord-markdown.
The vulnerability has been assigned a severity rating of HIGH.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
