HTML Injection Vulnerability in marky-markdown
Summary
GHSA-pxmp-fwjc-4x7q: HTML Injection in marky-markdown. Affects marky-markdown versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
marky-markdown is an npm package used for converting markdown to HTML. It provides a simple and convenient way to render markdown content. However, all versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com, but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co.
Vulnerability Detail
The HTML Injection vulnerability in marky-markdown allows an attacker to inject malicious HTML code into the rendered output. This can lead to various security issues, including cross-site scripting (XSS) attacks. By injecting malicious code, an attacker can execute arbitrary scripts, steal sensitive information, or manipulate the rendered content. The vulnerability originates from a validation bypass that fails to properly restrict iframe sources to youtube.com only.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Upgrading to the latest version of @npmcorp/marky-markdown is the recommended solution.
Conclusion
The HTML Injection vulnerability in marky-markdown can have serious security implications for web applications using this package. It is crucial to upgrade to the latest version of @npmcorp/marky-markdown to address this vulnerability and ensure the security of your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for marky-markdown →
FAQ
marky-markdown is an npm package used for converting markdown to HTML. It simplifies the process of rendering markdown content in web applications.
HTML Injection is a vulnerability that allows an attacker to inject malicious HTML code into a web application. This can lead to various security issues, including cross-site scripting (XSS) attacks.
The validation bypass in marky-markdown allows iframes with sub-domains of youtube.com, such as youtube.com.evil.co, to pass the validation check. This bypasses the intended restriction of only allowing iframes with youtube.com as the source.
The HTML Injection vulnerability in marky-markdown can allow an attacker to execute arbitrary scripts, steal sensitive information, or manipulate the rendered content. This can lead to unauthorized access, data breaches, and other security compromises.
Yes, upgrading to the latest version of @npmcorp/marky-markdown fixes this vulnerability. It is recommended to update your project's dependencies to ensure the vulnerability is mitigated.
References
Related vulnerabilities
Recent vulnerabilities recorded for marky-markdown.
